https://github.com/lldap/lldap logo
Powered by
STYT - Hi all, after upgrading to latest image ...
# troubleshooting
n
@xaverius666 is 
latest
by any chance a 
-rootless
image, accidentally?
@STYT can you check the contents of the 
/docker-entrypoint.sh
file in the container? Does it contain 
gosu
or not?
x
I just checked it correct.
May attach your compose, thanks
s
I believe latest is rootless as this was what I had when upgrading. I changed to latest-alpine and then it works
But I am up to running rootless so I am a bit clueless what I am missing to get that to work
Checking at docker hub latest tag seems to same as rootless tag
n
to confirm, can you check that the docker-entrypoint.sh is the -rootless one from the repository?
(see my links above)
s
Sure. Let me rebuild image again
n
you shouldn't have to rebuild
I think you can 
docker exec <your_container> "cat /docker-entrypoint.sh"
s
Got it but I went back to a working build a bit too quick maybe when not able to resolv the error
x
Rootless likely
Latest alpine dont 🫣
s
I believe so yes
n
yeah, I can confirm that 
latest
is rootless
@xaverius666 can you have a look? 🙂
@STYT if you want to switch to rootless, I think you just need a 
user: ${UID}:${GID}
in your docker-compose service
x
Only the 
latest
tag. This is where kinda tricky. Likely will playing the tag again 🤔
s
I had that actually but didn't work
x
Use 
latest-alpine
or 
latest-debian
s
There is no latest-rootless tag as in the announcment from @nitnelave
x
latest-alpine-rootless
or latest-debian-rootless
n
I think that's the issue: we didn't push a 
latest-rootless
but instead pushed 
latest
twice
s
My bad....I have only variables for UID and GID since earlier. Maybe missing something here
n
Just checking, did you put the UID and GID that you already have in the env variables, or did you just paste the 
${UID}:${GID}
? Maybe you need to copy/paste the values
s
I believe I might need to read-up a bit on docker rootless...I thought I could move container by container but seems to be the whole daemon, right? Currently running lldap on a Synology nas docker so not a native Debian machine atm.
n
No, it's not the whole daemon: root/rootless refers to the user inside the container, so I think you can have root inside the container even if your daemon is not root
and vice-versa, of course, if your daemon is root you can have non-root in the container
so far, you were starting the lldap container with the root user (inside the container), it was only downgrading to the provided user after starting
with rootless, it directly starts as the provided user
s
OK sounds more what I was aiming for. Start with removing root from containers where possible.
OK, explains why it stops immediatly with rootless, not able to fecth the secrets and just ends up in a loop.
Do you know if secrets should be possible? or are they locked to root when daemon is running as root?
n
Ah, here's a more detailed example with the full secrets API: https://forums.docker.com/t/unable-set-docker-secret-file-ownership-permissions/31336/2
x
afaik, the secrets follow/inherit permission from host or manipulate like the thread above also possible
s
Thank You for the links and help. I will try this out later to see if I can move to rootless.
PreviousNext
Powered by