Qfyilyi

I have a Docker volume mounted directly to the /usr/local/share/ca-certificates -folder.

certificate-folder:/usr/local/share/ca-certificates:ro

I'm using Tomcat for this setup, but a similar issue could be encountered with other frameworks as well. Base of the Dockerfile is like this:

FROM       tomcat:8.5-jre8

# other Dockerfile configuration

CMD ["/start.sh"]

With start.sh containing key lines

#!/usr/bin/env bash

update-ca-certificates 

# other startup related tasks

catalina.sh run

Issue with this setup is that it works as long as I'm running the container as root user. However, if I try to change to a designated user at the end of the Dockerfile with something like this

ENV TOMCAT_USER="tomcat" 

    TOMCAT_UID="8080" 

    TOMCAT_GROUP="tomcat" 

    TOMCAT_GID="8080"

RUN groupadd -r --gid $TOMCAT_GID $TOMCAT_GROUP && 

    useradd -r --uid $TOMCAT_UID --gid $TOMCAT_GID $TOMCAT_USER

RUN chown -R $TOMCAT_USER:$TOMCAT_GROUP /usr/local/tomcat

USER $TOMCAT_USER

So:

• Because the shell script is being run as $TOMCAT_USER, it can't run "update-ca-certificates" to install the certificates.


• Because certificates aren't added inside Dockerfile, update-ca-certificates can't be run inside Dockerfile.

Because of this I'm eventually getting SSL issues like this

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: 

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

So what would be the correct way to approach this kind of issue if I still wish to run the container as a designated $TOMCAT_USER?

As update-ca-certificates needs root permissions to update the certificates in /etc/ssl/certs, I only see three possible approaches (and one working solution − the third one below):

1. Remove update-ca-certificates from your entrypoint and add a RUN update-ca-certificates command before the line USER $TOMCAT_USER. (However, you are using a volume which won't be available at build time, so this couldn't work…)




2. Give sudo permissions (with no password) to your $TOMCAT_USER, and replace update-ca-certificates with sudo update-ca-certificates. (However, this solution may be unsatisfactory from a security perspective…)



3. 
   

   Remove USER $TOMCAT_USER from your Dockerfile; keep CMD ["/start.sh"], or ENTRYPOINT ["/start.sh"] if you prefer; and rely on the gosu tool, whose main use case precisely consists in downgrading from root to a non-privileged user, while enjoying better behavior than sudo w.r.t. TTY and signal forwarding.

   
   
   

   You'll just need to install gosu by doing for example:

   
   
   

   RUN apt-get update -y -q && 
   
     DEBIAN_FRONTEND=noninteractive 
   
     apt-get install -y -q --no-install-recommends gosu
   
   

   
   
   

   (as tomcat:8.5-jre8 is based on Debian) and use it by writing:

   
   
   

   
   

   start.sh

   
   

   
   
   

   #!/usr/bin/env bash
   
   update-ca-certificates 
   
   # other startup related tasks
   
   gosu $TOMCAT_UID:$TOMCAT_GID catalina.sh run