docker secrets with non root user

Question

I have a docker container run with a non root user for better security, but it seems it can't access the secrets I'm sharing with it:

Importing account from "/run/secrets/authority.priv.json" failed: Permission denied (os error 13)

I tried different solutions in my docker compose: 1. Setting the uid and gid to 1000 (uid/gid if the user inside the container) 2. Settting the mode to 0444 and even 0777

But none of these have worked, only using root allows me to use these secrets.

Any idea?

Bonus question: will it be the same issue within kubernetes?

The dockerfile:

FROM parity/parity:v2.2.1
LABEL maintainer="[email protected]"

# SAD but It seems impossible to read the secrets otherwise
USER root

VOLUME ["/home/parity/.local/share/io.parity.ethereum"]

ADD ./configPoANode.toml /home/parity/configPoANode.toml
ADD ./PoA.json /home/parity/PoA.json
ADD ./entrypoint.sh /home/parity/entrypoint.sh

ENTRYPOINT ["/home/parity/entrypoint.sh"]

appendix: repository (with user ROOT in the dockerfile):

Answer 1

This is because you are setting root user in the docker container and root owns all the monted volumes and files, not the parity user which I am not sure even exists.
I would dothe following:

Remove USER root from the dockerfile. It is root by default.

Check if parity user even exists in the container.

If not create it with the /home/parity directory.

Mount the volume and files as you did.

RUN chown -R parity:parity /home/parity gives the ownership of the newly created user.

Then tell the container to use the newly created user by default with USER parity

Add the entrypoint you might need to RUN chmod ug+x /home/parity/entrypoint.sh Which makes it executable for sure.

You are good to go (hopefully), you don't need to set any user when running the container, with the line USER parity it will use the parity user by default.

Answer 2

Use RUN --mount=type=secret,id=mysecret,uid=1000 cat /run/secrets/mysecret

Where mysecret is what you pass to docker build --secret id=mysecret,src=authority.priv.json and uid is the uid of parity user.

Answer 3

To expand on @nishanth-kottary's answer but for buildtools (very similar), you can:

1. run the command docker run -it --rm <YOUR_IMAGE_HERE> bash -c 'id -u $(whoami)' to get the uid of your user. Or you can use some other variation of this to get uid

2. next, in your Dockerfile you can do

RUN --mount=type=secret,id=mysecret,uid=<THE_ID_FROM_STEP_1>,target=/run/secrets/mysecret.json \
    cat /run/secrets/mysecret.json

3. Your build command would look like docker buildx build --secret id=pipconf,src=/run/secrets/authority.priv.json