Run opentsdb container as non-root user


I’m trying to build a custom image of opentsdb to run as non-root user. Our k8s clusters have security policies that doesn’t allow containers to run as root. I’m utilizing an existing Dockerfile from here

Below is my Docker file where I have added extra step to create a new user ‘opentsdb’ and at the end running it as USER ‘opentsdb’

FROM alpine:latest

ENV JAVA_HOME /usr/lib/jvm/java-1.8-openjdk
ENV PATH $PATH:/usr/lib/jvm/java-1.8-openjdk/bin/
ENV ALPINE_PACKAGES "rsyslog bash openjdk8 make wget libgd libpng libjpeg libwebp libjpeg-turbo cairo pango lua"
ENV BUILD_PACKAGES "build-base autoconf automake git python3-dev cairo-dev pango-dev gd-dev lua-dev readline-dev libpng-dev libjpeg-turbo-dev libwebp-dev sed"
ENV HBASE_OPTS "-XX:+UseConcMarkSweepGC -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"
ENV JVMARGS "-XX:+UseConcMarkSweepGC -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -enableassertions -enablesystemassertions"

RUN addgroup opentsdb && adduser -D -u 100 -G opentsdb opentsdb
# Tini is a tiny init that helps when a container is being culled to stop things nicely
ADD${TINI_VERSION}/tini-static-amd64 /tini
RUN chmod +x /tini
ENTRYPOINT ["/tini", "--"]

# Add the base packages we'll need
RUN apk --update add apk-tools \
    && apk add ${ALPINE_PACKAGES} \
      # repo required for gnuplot \
      --repository \
    && mkdir -p /opt/opentsdb

WORKDIR /opt/opentsdb/

# Add build deps, build opentsdb, and clean up afterwards.
RUN set -ex && apk add --virtual builddeps ${BUILD_PACKAGES}

RUN ln -s /usr/bin/python3 /usr/bin/python

RUN wget --no-check-certificate \
    -O v${TSDB_VERSION}.zip \${TSDB_VERSION}.zip \
  && unzip v${TSDB_VERSION}.zip \
  && rm v${TSDB_VERSION}.zip \
  && cd /opt/opentsdb/opentsdb-${TSDB_VERSION} \
  && echo "tsd.http.request.enable_chunked = true" >> src/opentsdb.conf \
  && echo "tsd.http.request.max_chunk = 1000000" >> src/opentsdb.conf 

RUN cd /opt/opentsdb/opentsdb-${TSDB_VERSION} \
  && find . | xargs grep -s | cut -f1 -d : | xargs sed -i "s/http:\/\/central/https:\/\/repo1/g" \
  && find . | xargs grep -s | cut -f1 -d : | xargs sed -i "s/http:\/\/repo1/https:\/\/repo1/g" \
  && ./ \
  && cp build-aux/install-sh build/build-aux \
  && cd build \
  && make install \
  && cd / \
  && rm -rf /opt/opentsdb/opentsdb-${TSDB_VERSION}

RUN cd /tmp && \
    wget --no-check-certificate${GNUPLOT_VERSION}/gnuplot-${GNUPLOT_VERSION}.tar.gz && \
    tar xzf gnuplot-${GNUPLOT_VERSION}.tar.gz && \
    cd gnuplot-${GNUPLOT_VERSION} && \
    ./configure && \
    make install && \
    cd /tmp && rm -rf /tmp/gnuplot-${GNUPLOT_VERSION} && rm /tmp/gnuplot-${GNUPLOT_VERSION}.tar.gz

RUN apk del builddeps && rm -rf /var/cache/apk/*

#Install HBase and scripts
RUN mkdir -p /data/hbase /root/.profile.d /opt/downloads
WORKDIR /opt/downloads
RUN wget -O hbase-${HBASE_VERSION}.bin.tar.gz${HBASE_VERSION}/hbase-${HBASE_VERSION}-bin.tar.gz \
    && tar xzvf hbase-${HBASE_VERSION}.bin.tar.gz \
    && mv hbase-${HBASE_VERSION} /opt/hbase \
    && rm -r /opt/hbase/docs \
    && rm hbase-${HBASE_VERSION}.bin.tar.gz

# Add misc startup files
RUN ln -s /usr/local/share/opentsdb/etc/opentsdb /etc/opentsdb \
    && rm /etc/opentsdb/opentsdb.conf \
    && mkdir /opentsdb-plugins
ADD files/opentsdb.conf /etc/opentsdb/opentsdb.conf.sample
ADD files/hbase-site.xml /opt/hbase/conf/hbase-site.xml.sample
ADD files/ /opt/bin/
ADD files/ /opt/bin/
ADD files/ /opt/bin/
ADD files/ /

# Fix ENV variables in installed scripts
RUN for i in /opt/bin/ /opt/bin/ /opt/bin/; \
    do \
        sed -i "s#::JAVA_HOME::#$JAVA_HOME#g; s#::PATH::#$PATH#g; s#::TSDB_VERSION::#$TSDB_VERSION#g;" $i; \

RUN echo "export HBASE_OPTS=\"${HBASE_OPTS}\"" >> /opt/hbase/conf/

#4242 is tsdb, rest are hbase ports
EXPOSE 60000 60010 60030 4242 16010 16070
USER opentsdb

#HBase is configured to store data in /data/hbase, vol-mount it to persist your data.
VOLUME ["/data/hbase", "/tmp", "/opentsdb-plugins"]

CMD ["/"]

however the newly built image is throwing error and says permission denied for /opt/bin/ files. And the opentsdb is not getting deployed correctly.

On local using docker desktop, everything works fine using root, when I run below command docker run -dp 4242:4242 petergrace/opentsdb-docker

Do i need to use any chown commands too ? Could you help how to make opentsdb get deployed correctly using uid 100 ? Thanks in advance!

The image or the contianer when you run it on Kubernetes?

It depends on the files it wants to read or write. Your mentioned error message is not specific enough, but yes, it is very likely that you need to use chown so the new user will own those files. It is also possible that the container does not support running it as a non-root user. I don’t know opentsdb enough.