Docker container wont start with stricter security set up
I try to run this container inside a k8s environment (so the Docker Version). There it will run with the given user and group id and as nonroot
What version are you using? 2.0.59@sha256:c7e93705edb333c707f28077d04ca6a1518d71dd6c824eec6b4a9c188e97c7ed
Wat OS are you running? Linux
Are you using Docker or as a service? Docker (inside k3s Kubernetes)
Which debrid provider are you using? none as it wont start
Which downloader are you using? none as it wont start
** ENV ** TZ: ${TIMEZONE} (which results in Europe/Berlin) PUID: 568 PGID: 568
Please attach a log file here with the log setting set to debug
/run/s6/basedir/scripts/rc.init: line 26: /docker-mods: Permission denied
/run/s6/basedir/scripts/rc.init: warning: hook /docker-mods exited 126
[migrations] started
[migrations] no migrations found
groupmod: /etc/group.77: Permission denied
groupmod: cannot lock /etc/group; try again later.
usermod: /etc/passwd.78: Permission denied
usermod: cannot lock /etc/passwd; try again later.
───────────────────────────────────────
_____ __ __ _____ _____ _____ _____
| | | | __|_ _| | |
| --| | |__ | | | | | | | | |
|_____|_____|_____| |_| |_____|_|_|_|
_____ __ __ _ __ ____
| __ | | | | | | \
| __ -| | | | |__| | |
|_____|_____|_|_____|____/
Based on images from linuxserver.io
Based on images from linuxserver.io
───────────────────────────────────────
To support LSIO projects visit:
https://www.linuxserver.io/donate/
───────────────────────────────────────
GID/UID
───────────────────────────────────────
User UID: 911
User GID: 1001
───────────────────────────────────────
/etc/s6-overlay/s6-rc.d/init-adduser/run: line 44: lsiown: command not found
/etc/s6-overlay/s6-rc.d/init-adduser/run: line 45: lsiown: command not found
/etc/s6-overlay/s6-rc.d/init-adduser/run: line 46: lsiown: command not found
s6-rc: warning: unable to start service init-adduser: command exited 127
The thing i found so far was https://github.com/linuxserver/docker-jellyfin/issues/184#issuecomment-1382578624
We don't test, support or go out of our way to ensure our images (and mods) works in a rootless environment.
For people searching for a quick fix:
...
securityContext:
allowPrivilegeEscalation: false
...
pod:
securityContext:
runAsUser: 0
runAsGroup: 0
runAsNonRoot: false
...