24
votes
Accepted
How to change the owner of VOLUME directory in Dockerfile?
As stated in the documentation, VOLUME instruction inherits the directory content and permissions existing in the container, so you can workaround the problem with a dockerfile like this:
FROM ubuntu:...
- 11.3k
20
votes
Accepted
Permission denied within mounted volume inside Podman container
Thanks to the people here, the solution is quite simple (but not obvious):
My GNU/Linux container host has SELinux activated, and that's why I was having permissions problems. The solution is to ...
- 431
9
votes
Accepted
How to restrict filesystem access in Atlassian Bamboo builds?
There is currently no ability to restrict jobs which are able to run on the same agent from potentially interacting with each other. There are a bunch of feature requests asking for this sort of ...
- 1,734
5
votes
Accepted
How do you limit access to the production environment in the company you work for?
If your question is how to manage database changes consider something like Flyway. This lets you control your changes via tracked config files in your repository and apply them via an automated & ...
- 251
4
votes
How do you limit access to the production environment in the company you work for?
You could embed database schema and data changes into source code control by using a concept called database migrations. These can then be executed on dev and staging environments as part of a ...
- 650
4
votes
How to change the owner of VOLUME directory in Dockerfile?
I had a similar problem, this worked for me:
Write Docker file with:
# Create app layer:
FROM python:3.4
# Create app user & group "testuser" with IDs:
RUN groupadd -r testuser --gid 1234 &&...
- 141
4
votes
How do you limit access to the production environment in the company you work for?
I see a first problem, DevOps is about building teams able to handle an application from build to exploitation.
So your devs should have access to the databases, you quoted various cases which are the ...
- 11.3k
3
votes
Ansible tmp files created with odd permissions
The reason for the failure is that the server in question, unlike all the others, had sftp disabled.
Why the error messages are what they are, I don't know (why the errant scp transfer mechanism ...
- 313
3
votes
Accepted
Docker mounts files as uid 1001
Sounds like you are using a host volume. Docker doesn't perform any uid/gid mapping on the files mounted into the container, this is how bind mounts work in Linux. On Windows and Mac, Docker Desktop ...
- 3,230
3
votes
kubernetes: how to set "top node" and "top pod" permissions?
Thanks to arghya-sadhu's comments on stackoverflow, I've got it working:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: get-pod-and-node
labels:
rbac.authorization....
- 61
3
votes
Accepted
What are the different job permissions possible in Jenkins, and what are the reasons you would use each?
There are 4 type of user permissions in Jenkins:
Open
Jenkins is accessible for everyone with no permissions. Basically anyone can do anything. This should be used for internal use only.
User ...
- 7,791
2
votes
Accepted
Permission errors with non-root USER when running on Linux
As described in https://github.com/docker-library/tomcat/issues/35, this is related to the storage driver used (aufs). Changing to use overlay2 solved the issue:
https://docs.docker.com/storage/...
- 141
2
votes
Accepted
Using docker with users leaves files belonging to the subuid/subgid
docker run -ti --rm \
-v $PWD:/workdir \
-v $HOME/.ssh:/root/.ssh \
--user $(id -u):$(id -g) \
dockerizedxyz "$@"
As long as you're not doing anything funny with the entrypoint in the ...
- 1,395
2
votes
Assign Directory Read/Write Privileges to Azure Service Principal from the command line?
What you need here are the az ad app permission commands.
Here is a complete example (assuming powershell):
$apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory
$...
1
vote
What are the best practices for sharing production Postgres access with developers?
We keep a RO clone of the important DB's. Any dev can access the basic RO clone if he's in the right dev group vpn, because the cloudsql instances are deployed in a private service net that peers ...
- 111
1
vote
Docker mounts files as uid 1001
Ideally dont run docker as superuser(root). You should create a user within dockerfile and chown the file system with that user. You can create a user and then add access to that user on the file ...
1
vote
Accepted
Dockerized node.js and bind mount permission problem
In your Dockerfile:
ARG UID=1000
ARG GID=1000
RUN usermod -u $UID node && groupmod -g $GID node
Then using docker build:
docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) .
The ...
- 556
1
vote
Is there a way to tell if an Azure Devops Extension is secure to use?
Can't comment yet, but most extensions host their source code publicly. So you could read the source code to check if something is going on that you don't want.
If the source code is not available, ...
- 156
1
vote
Add permissions to readers (DevOps Web Portal)
Usually each projects would have teams defined with the team members. So if you have a team defined then add the team to the contributors list.
- 21
1
vote
Provide customers with access to Azure Container Registry
There is a balancing act here between the simplicity and maintainability of your solution, and how auditable creating separate service principals or users for each of your external customers. I ...
- 11.6k
1
vote
See which Roles contain a GCLOUD Permisson
Looks like only the roles/billing.admin:
https://cloud.google.com/iam/docs/understanding-roles#billing-roles
- 131
1
vote
What is the most common server permission policy for web application deployment?
I usually stick to a 755 (or rwxr-xr-x) on my web root, but I do not think this is the issue you're running into since your directory is already set to that. nginx should have access to your ...
- 1,536
1
vote
What is the most common server permission policy for web application deployment?
According to the Nginx docs you can configure the user which runs Nginx. By default the user is nobody.
You can read this Ask Ubuntu question that explains how to configure Apache2 to run as a ...
- 1,018
1
vote
How do you limit access to the production environment in the company you work for?
... me and another coworker ... are the only people who have access to the production database.
That's a good starting position.
All too often, DBA's find themselves trying to close the stable door ...
- 148
Only top scored, non community-wiki answers of a minimum length are eligible