chore: 初始化项目仓库
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1067" height="600" viewBox="0 0 1067 600" style="max-width: 100%; height: auto; cursor: default;"><defs><pattern id="checkerboard" width="20" height="20" patternUnits="userSpaceOnUse"><rect width="10" height="10" fill="#e0e0e0"/><rect x="10" y="0" width="10" height="10" fill="#ffffff"/><rect x="0" y="10" width="10" height="10" fill="#ffffff"/><rect x="10" y="10" width="10" height="10" fill="#e0e0e0"/></pattern></defs><rect width="100%" height="100%" fill="url(#checkerboard)"/><rect width="100%" height="100%" fill="rgba(255, 255, 255, 1)"/><!----><foreignObject x="0" y="0" width="100%" height="100%" style="pointer-events: none;"><div xmlns="http://www.w3.org/1999/xhtml" style="width: 100%; height: 100%; display: flex; align-items: center; justify-content: center; gap: 22px; font-family: sans-serif; font-weight: 600;"><div style="order: 1; width: 123px; height: 123px; display: flex; align-items: center; justify-content: center; background-color: transparent; backdrop-filter: none; border-radius: 0px;"><div style="max-width: 103px; max-height: 103px; flex-shrink: 0; color: rgb(0, 0, 0); filter: drop-shadow(rgba(0, 0, 0, 0) 0px 0px 0px); display: flex; align-items: center; justify-content: center; border-radius: 6%; overflow: hidden;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 185" width="100%" height="100%" preserveAspectRatio="xMidYMid meet"><path fill="#2396ed" d="M250.716 70.497c-5.765-4-18.976-5.5-29.304-3.5c-1.2-10-6.725-18.749-16.333-26.499l-5.524-4l-3.844 5.75c-4.803 7.5-7.205 18-6.485 28c.24 3.499 1.441 9.749 5.044 15.249c-3.362 2-10.328 4.5-19.455 4.5H1.155l-.48 2c-1.682 9.999-1.682 41.248 18.014 65.247c14.892 18.249 36.99 27.499 66.053 27.499c62.93 0 109.528-30.25 131.386-84.997c8.647.25 27.142 0 36.51-18.75c.24-.5.72-1.5 2.401-5.249l.961-2zM139.986 0h-26.42v24.999h26.42zm0 29.999h-26.42v24.999h26.42zm-31.225 0h-26.42v24.999h26.42zm-31.225 0H51.115v24.999h26.421zM46.311 59.998H19.89v24.999h26.42zm31.225 0H51.115v24.999h26.421zm31.225 0h-26.42v24.999h26.42zm31.226 0h-26.422v24.999h26.422zm31.225 0H144.79v24.999h26.422z"/></svg></div></div><span style="order: 0; font-size: 86px; color: rgb(0, 0, 0); text-shadow: rgba(0, 0, 0, 0.09) 0px 0px 0px; line-height: 1; white-space: nowrap;">构建时</span><span style="order: 2; font-size: 86px; color: rgb(0, 0, 0); text-shadow: rgba(0, 0, 0, 0.09) 0px 0px 0px; line-height: 1; white-space: nowrap;">指定用户启动</span></div></foreignObject><g class="ratio-guide" style="display: none;"><rect x="0.16666666666674246" y="0" width="1066.6666666666665" height="600" fill="none" stroke="rgba(255,0,0,0.5)" stroke-width="2" stroke-dasharray="10 5"/><text x="10.166666666666742" y="30" fill="rgba(255,0,0,0.5)" font-size="20">16:9</text></g><rect x="0" y="0" width="100%" height="100%" fill="none" stroke="rgba(255,0,0,0.8)" stroke-width="2" class="canvas-border" style="display: none;"/></svg>
|
||||
|
After Width: | Height: | Size: 2.9 KiB |
@@ -0,0 +1,89 @@
|
||||
---
|
||||
title: Docker 构建时指定用户启动
|
||||
published: 2025-04-01
|
||||
image: /posts/docker-user-start/img/cover.svg
|
||||
description: 解决 Docker 容器默认以 root 用户运行导致的权限问题，指定非 root 用户启动应用。
|
||||
tags: ['Docker', '运维', 'Linux']
|
||||
draft: false
|
||||
---
|
||||
|
||||
## 前言
|
||||
|
||||
我们在 Linux 使用应用时，往往不会直接使用 root 用户作为应用启动项，但 Dockerfile 默认就是 root 用户，导致挂载生成的文件路径往往是 root 权限，非 root 用户访问就很不方便。
|
||||
|
||||
## 解决方案
|
||||
|
||||
### 1. 安装用户管理工具
|
||||
|
||||
若镜像非自带用户管理：
|
||||
|
||||
```dockerfile
|
||||
# 权限管理
|
||||
RUN apk add --no-cache shadow
|
||||
```
|
||||
|
||||
### 2. 创建用户并修改权限
|
||||
|
||||
```dockerfile
|
||||
# 创建用户组和用户
|
||||
RUN addgroup -S <app_user_group> && adduser -S -G <app_user_group> <app_user>
|
||||
|
||||
# 修改目录权限
|
||||
RUN chown -R <app_user_group>:<app_user> /data
|
||||
```
|
||||
|
||||
### 3. 指定用户启动
|
||||
|
||||
执行 docker 时加 `--user` 参数：
|
||||
|
||||
```bash
|
||||
docker run -it --user <app_user> <app_image>:<image_version>
|
||||
```
|
||||
|
||||
## 完整示例
|
||||
|
||||
```dockerfile
|
||||
FROM alpine:latest
|
||||
|
||||
# 国内源
|
||||
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.ustc.edu.cn/g' /etc/apk/repositories
|
||||
|
||||
RUN apk update --no-cache
|
||||
# 权限管理
|
||||
RUN apk add --no-cache shadow
|
||||
# 调试
|
||||
RUN apk add --no-cache bash
|
||||
# 设置时区
|
||||
RUN apk add --no-cache tzdata
|
||||
|
||||
ENV TZ=Asia/Shanghai
|
||||
|
||||
# 创建用户组和用户
|
||||
RUN addgroup -S glog && adduser -S -G glog glog
|
||||
|
||||
COPY ./glog_static_musl_1 /app/
|
||||
|
||||
RUN mkdir /data
|
||||
|
||||
VOLUME [ "/data" ]
|
||||
WORKDIR /data
|
||||
|
||||
# 修改权限
|
||||
RUN chown -R glog:glog /data
|
||||
RUN chown -R glog:glog /app
|
||||
|
||||
# 指定用户启动
|
||||
USER glog
|
||||
CMD [ "/app/glog_static_musl_1", "logsweb", "./conf.ini" ]
|
||||
```
|
||||
|
||||
## 总结
|
||||
|
||||
关键步骤：
|
||||
|
||||
1. `apk add --no-cache shadow` - 安装用户管理工具
|
||||
2. `addgroup` + `adduser` - 创建用户
|
||||
3. `chown -R` - 修改目录权限
|
||||
4. `USER <username>` - 指定运行用户
|
||||
|
||||
这样容器内的应用就不再以 root 身份运行，更加安全。
|
||||
Reference in New Issue
Block a user