diff --git a/changelog.d/11209.docker b/changelog.d/11209.docker
new file mode 100644
index 0000000000..838b165ac9
--- /dev/null
+++ b/changelog.d/11209.docker
@@ -0,0 +1 @@
+Avoid changing userid when started as a non-root user, and no explicit `UID` is set.
diff --git a/docker/README.md b/docker/README.md
index 38d182bf45..4349e71f87 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -65,7 +65,8 @@ The following environment variables are supported in `generate` mode:
* `SYNAPSE_DATA_DIR`: where the generated config will put persistent data
such as the database and media store. Defaults to `/data`.
* `UID`, `GID`: the user id and group id to use for creating the data
- directories. Defaults to `991`, `991`.
+ directories. If unset, and no user is set via `docker run --user`, defaults
+ to `991`, `991`.
## Running synapse
@@ -97,7 +98,9 @@ The following environment variables are supported in `run` mode:
`<SYNAPSE_CONFIG_DIR>/homeserver.yaml`.
* `SYNAPSE_WORKER`: module to execute, used when running synapse with workers.
Defaults to `synapse.app.homeserver`, which is suitable for non-worker mode.
-* `UID`, `GID`: the user and group id to run Synapse as. Defaults to `991`, `991`.
+* `UID`, `GID`: the user and group id to run Synapse as. If unset, and no user
+ is set via `docker run --user`, defaults to `991`, `991`. Note that this user
+ must have permission to read the config files, and write to the data directories.
* `TZ`: the [timezone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) the container will run with. Defaults to `UTC`.
For more complex setups (e.g. for workers) you can also pass your args directly to synapse using `run` mode. For example like this:
@@ -186,7 +189,7 @@ point to another Dockerfile.
## Disabling the healthcheck
If you are using a non-standard port or tls inside docker you can disable the healthcheck
-whilst running the above `docker run` commands.
+whilst running the above `docker run` commands.
```
--no-healthcheck
@@ -212,7 +215,7 @@ If you wish to point the healthcheck at a different port with docker command, ad
## Setting the healthcheck in docker-compose file
You can add the following to set a custom healthcheck in a docker compose file.
-You will need docker-compose version >2.1 for this to work.
+You will need docker-compose version >2.1 for this to work.
```
healthcheck:
@@ -226,5 +229,5 @@ healthcheck:
## Using jemalloc
Jemalloc is embedded in the image and will be used instead of the default allocator.
-You can read about jemalloc by reading the Synapse
+You can read about jemalloc by reading the Synapse
[README](https://github.com/matrix-org/synapse/blob/HEAD/README.rst#help-synapse-is-slow-and-eats-all-my-ram-cpu).
diff --git a/docker/start.py b/docker/start.py
index 16d6a8208a..ec9eeb49ae 100755
--- a/docker/start.py
+++ b/docker/start.py
@@ -120,6 +120,7 @@ def generate_config_from_template(config_dir, config_path, environ, ownership):
]
if ownership is not None:
+ log(f"Setting ownership on /data to {ownership}")
subprocess.check_output(["chown", "-R", ownership, "/data"])
args = ["gosu", ownership] + args
@@ -144,12 +145,18 @@ def run_generate_config(environ, ownership):
config_path = environ.get("SYNAPSE_CONFIG_PATH", config_dir + "/homeserver.yaml")
data_dir = environ.get("SYNAPSE_DATA_DIR", "/data")
+ if ownership is not None:
+ # make sure that synapse has perms to write to the data dir.
+ log(f"Setting ownership on {data_dir} to {ownership}")
+ subprocess.check_output(["chown", ownership, data_dir])
+
# create a suitable log config from our template
log_config_file = "%s/%s.log.config" % (config_dir, server_name)
if not os.path.exists(log_config_file):
log("Creating log config %s" % (log_config_file,))
convert("/conf/log.config", log_config_file, environ)
+ # generate the main config file, and a signing key.
args = [
"python",
"-m",
@@ -168,29 +175,23 @@ def run_generate_config(environ, ownership):
"--open-private-ports",
]
# log("running %s" % (args, ))
-
- if ownership is not None:
- # make sure that synapse has perms to write to the data dir.
- subprocess.check_output(["chown", ownership, data_dir])
-
- args = ["gosu", ownership] + args
- os.execv("/usr/sbin/gosu", args)
- else:
- os.execv("/usr/local/bin/python", args)
+ os.execv("/usr/local/bin/python", args)
def main(args, environ):
mode = args[1] if len(args) > 1 else "run"
- desired_uid = int(environ.get("UID", "991"))
- desired_gid = int(environ.get("GID", "991"))
- synapse_worker = environ.get("SYNAPSE_WORKER", "synapse.app.homeserver")
- if (desired_uid == os.getuid()) and (desired_gid == os.getgid()):
- ownership = None
- else:
- ownership = "{}:{}".format(desired_uid, desired_gid)
- if ownership is None:
- log("Will not perform chmod/gosu as UserID already matches request")
+ # if we were given an explicit user to switch to, do so
+ ownership = None
+ if "UID" in environ:
+ desired_uid = int(environ["UID"])
+ desired_gid = int(environ.get("GID", "991"))
+ ownership = f"{desired_uid}:{desired_gid}"
+ elif os.getuid() == 0:
+ # otherwise, if we are running as root, use user 991
+ ownership = "991:991"
+
+ synapse_worker = environ.get("SYNAPSE_WORKER", "synapse.app.homeserver")
# In generate mode, generate a configuration and missing keys, then exit
if mode == "generate":
|
