如何向Docker容器添加用户？

Question

我有一个docker容器，里面运行着一些进程（uwsgi和celery）。我想为这些进程创建一个celery用户和一个uwsgi用户，以及一个它们都将属于的worker组，以便分配权限。

我尝试将run adduser uwsgi和run adduser celery添加到我的Dockerfile中，但这会导致问题，因为这些命令提示输入（我已经发布了下面构建的响应）。

将用户添加到Docker容器中以便为在容器中运行的工作者设置权限的最佳方法是什么？

我的Docker映像是从官方的Ubuntu14.04基础上构建的。

以下是运行adduser命令时Dockerfile的输出：

Adding user `uwsgi' ...
Adding new group `uwsgi' (1000) ... 
Adding new user `uwsgi' (1000) with group `uwsgi' ... 
Creating home directory `/home/uwsgi' ...
Copying files from `/etc/skel' ... 
[91mEnter new UNIX password: Retype new UNIX password: [0m 
[91mpasswd: Authentication token manipulation error
passwd: password unchanged
[0m 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 563.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 564.
[0m 
Try again? [y/N] 
Changing the user information for uwsgi
Enter the new value, or press ENTER for the default
    Full Name []: 
Room Number []:     Work Phone []:  Home Phone []:  Other []: 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 589.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 590.
[0m 
Is the information correct? [Y/n] 
---> 258f2f2f13df 
Removing intermediate container 59948863162a 
Step 5 : RUN adduser celery 
---> Running in be06f1e20f64 
Adding user `celery' ...
Adding new group `celery' (1001) ... 
Adding new user `celery' (1001) with group `celery' ... 
Creating home directory `/home/celery' ...
Copying files from `/etc/skel' ... 
[91mEnter new UNIX password: Retype new UNIX password: [0m 
[91mpasswd: Authentication token manipulation error
passwd: password unchanged
[0m 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 563.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 564.
[0m 
Try again? [y/N] 
Changing the user information for celery
Enter the new value, or press ENTER for the default
    Full Name []:   Room Number []:     Work Phone []: 
Home Phone []:  Other []: 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 589.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 590.
[0m 
Is the information correct? [Y/n] 

Answer 1

诀窍是使用useradd而不是其交互式包装器adduser。我通常使用以下方式创建用户：

RUN useradd -ms /bin/bash newuser

它为用户创建一个主目录并确保bash是默认shell。

然后可以添加：

USER newuser
WORKDIR /home/newuser

到你的DockerFile。之后的每个命令以及交互式会话都将以用户newuser的身份执行：

docker run -t -i image
newuser@131b7ad86360:~$

在调用user命令之前，您可能必须授予newuser执行要运行的程序的权限。

出于安全考虑，在容器内使用非特权用户是一个好主意。它也有一些缺点。最重要的是，从您的映像派生映像的人员必须切换回root，然后才能以超级用户权限执行命令。