# Openshift-nginx docker image running as non-root **URL:** \ **Category:** NGINX\ **Created:** [May 4, 2016, 11:25pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565 "2016-05-04T23:25:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [May 4, 2016, 11:25pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565/1 "2016-05-04T23:25:20Z")
Hi, I have been playing around with the [https://github.com/nginxinc/openshift-nginx](https://github.com/nginxinc/openshift-nginx) dockerfile and trying to find a way to run run nginx as non-root with openshift/k8/docker. I am currently getting the error: nginx: [alert] could not open error log file: open() “/var/log/nginx/error.log” failed (13: Permission denied) 2016/05/04 20:51:09 [warn] 1#1: the “user” directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5 2016/05/04 20:51:09 [emerg] 1#1: open() “/etc/nginx/conf.d/default.conf” failed (13: Permission denied) in /etc/nginx/nginx.conf:33 I have alredy added to my Dockerfile: Run … && chmod 777 /etc/nginx/nginx.conf && chmod 777 /var/run && chmod 777 /etc/nginx/conf.d/default.conf I also run bash on the container and was albe to “cat” the “default.conf” and the “nginx.conf” files. I am not sure if its the correct place to put this question, but I got here from [http://mailman.nginx.org/pipermail/nginx-devel/2015-November/007511.html](http://mailman.nginx.org/pipermail/nginx-devel/2015-November/007511.html) (as you can notice, I have copied the beginning of the email from Scott´s email. Hope you don´t mind!=o) ) Best regards, Paulo Leal ---
**Author:** ![Paulo\_Leal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5f9b8f/32.png) [@Paulo\_Leal](https://www.ruby-forum.com/u/Paulo_Leal)\ **Post date:** [May 4, 2016, 11:51pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565/2 "2016-05-04T23:51:02Z")
On Wed, May 04, 2016 at 06:25:01PM -0300, Paulo Leal wrote: Hi there, Completely untested by me; and I’ve not used openshift or docker, but: > I have been playing around with the > [https://github.com/nginxinc/openshift-nginx](https://github.com/nginxinc/openshift-nginx) dockerfile and trying to find > a way to run run nginx as non-root with openshift/k8/docker. > I am currently getting the error: > nginx: [alert] could not open error log file: open() > “/var/log/nginx/error.log” failed (13: Permission denied) That says that the user you run as cannot open that file. ls -ld / /var /var/log /var/log/nginx ls -l /var/log/nginx/error.log You may need a “-Z” in there too, if you have some extra security enabled. Does your user have permission to write the current error.log file; or to create a new one? If not, do whatever it takes to make that possible. You do mention some “chmod” commands below, but none that refer to this directory or file. > 2016/05/04 20:51:09 [warn] 1#1: the “user” directive makes sense only if > the master process runs with super-user privileges, ignored in > /etc/nginx/nginx.conf:5 That is harmless; if you intend to run as non-root, you can remove that directive from the config file. > 2016/05/04 20:51:09 [emerg] 1#1: open() “/etc/nginx/conf.d/default.conf” > failed (13: Permission denied) in /etc/nginx/nginx.conf:33 That suggests that your user can read /etc/nginx/nginx.conf, but cannot read /etc/nginx/conf.d/default.conf “ls -ld” or “ls -ldZ” every directory from the root to that one. Perhaps there is something there that shows why you are blocked. > I have alredy added to my Dockerfile: > Run … > && chmod 777 /etc/nginx/nginx.conf > && chmod 777 /var/run > && chmod 777 /etc/nginx/conf.d/default.conf 777 is possibly excessive; but if it works for you, it works. If you don’t have “x” permissions on /etc/nginx/conf.d, though, you probably won’t be able to read the default.conf file within. > I also run bash on the container and was albe to “cat” the “default.conf” > and the “nginx.conf” files. Do you do that as the same user/group that you run nginx as? Good luck with it, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Paulo\_Leal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5f9b8f/32.png) [@Paulo\_Leal](https://www.ruby-forum.com/u/Paulo_Leal)\ **Post date:** [May 5, 2016, 5:57pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565/3 "2016-05-05T17:57:34Z")
Hi. Am 04-05-2016 23:50, schrieb Francis D.: > > > > enabled. > > Does your user have permission to write the current error.log file; > or to create a new one? If not, do whatever it takes to make that > possible. > > You do mention some “chmod” commands below, but none that refer to this > directory or file. In openshift you normally not know with which user your run. [https://docs.openshift.org/latest/architecture/additional\_concepts/authorization.html#scc-strategies](https://docs.openshift.org/latest/architecture/additional_concepts/authorization.html#scc-strategies) I think the default is ‘MustRunAsRange’, this suggest this file. [https://github.com/openshift/openshift-ansible/blob/master/roles/openshift\_master/templates/master.yaml.v1.j2#L177](https://github.com/openshift/openshift-ansible/blob/master/roles/openshift_master/templates/master.yaml.v1.j2#L177) There is a solution to run for a dedicated user id. [https://docs.openshift.org/latest/creating\_images/guidelines.html#use-uid](https://docs.openshift.org/latest/creating_images/guidelines.html#use-uid) You should change the location of the pid file and you can use a syslog server for the logs. I have created a more or less ready to use solution. > **[GitHub - git001/nginx-osev3](https://github.com/git001/nginx-osev3)** > > Contribute to git001/nginx-osev3 development by creating an account on GitHub. Please tell me if the solution is helpful for you. I can then make a pull request to the [https://github.com/nginxinc/openshift-nginx](https://github.com/nginxinc/openshift-nginx) . > > I also run bash on the container and was albe to “cat” the > > “default.conf” > > and the “nginx.conf” files. > > Do you do that as the same user/group that you run nginx as? To OP: the output of ’ id && ps axfu && ls -laR /etc/nginx/ ’ would be interesting. In general the Images in openshift are running with a random user id which it makes difficult to set proper file permissions :-/ You can define some service accounts to be able to run as root, this should be used very carefully as in non PaaS environments ;-). Cheers Aleks ---
**Author:** ![Paulo\_Leal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5f9b8f/32.png) [@Paulo\_Leal](https://www.ruby-forum.com/u/Paulo_Leal)\ **Post date:** [May 5, 2016, 7:14pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565/4 "2016-05-05T19:14:41Z")
Hi, I added the lines to my dockerfile Run … && chmod 777 /var/log/nginx / && rm -rf /var/log/nginx/error.log / && rm -rf /var/log/nginx/access.log It worked for me! Thanks for your help. Paulo Leal ---
**Author:** ![Paulo\_Leal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5f9b8f/32.png) [@Paulo\_Leal](https://www.ruby-forum.com/u/Paulo_Leal)\ **Post date:** [May 6, 2016, 2:10pm UTC](https://www.ruby-forum.com/t/openshift-nginx-docker-image-running-as-non-root/244565/5 "2016-05-06T14:10:53Z")
Am 05-05-2016 19:14, schrieb Paulo Leal: > It worked for me! > When you want to read the files you call ### oc rsh cat /var/log/nginx/error.log ### or something similar, right. Would it not be nicer to get it via oc logs -f \ oc logs -f \ I think for POC (Prove of concept) the local logs setup woks but when you want more production readiness you should consider to log to a syslog server. IMHO. Maybe you can reuse the aggregating logs setup from openshift. [https://docs.openshift.org/latest/install\_config/aggregate\_logging.html](https://docs.openshift.org/latest/install_config/aggregate_logging.html) with [http://docs.fluentd.org/articles/in\_syslog](http://docs.fluentd.org/articles/in_syslog) or something similar. Cheers Aleks