23 votes
Accepted

How to change the owner of VOLUME directory in Dockerfile?

As stated in the documentation, VOLUME instruction inherits the directory content and permissions existing in the container, so you can workaround the problem with a dockerfile like this: FROM ubuntu:...
  • 11.1k
11 votes
Accepted

Permission denied within mounted volume inside Docker/Podman container

Thanks to the people here, the solution is quite simple (but not obvious): My GNU/Linux container host has SELinux activated, and that's why I was having permissions problems. The solution is to ...
  • 271
9 votes
Accepted

How to restrict filesystem access in Atlassian Bamboo builds?

There is currently no ability to restrict jobs which are able to run on the same agent from potentially interacting with each other. There are a bunch of feature requests asking for this sort of ...
  • 1,644
5 votes
Accepted

How do you limit access to the production environment in the company you work for?

If your question is how to manage database changes consider something like Flyway. This lets you control your changes via tracked config files in your repository and apply them via an automated & ...
4 votes

How do you limit access to the production environment in the company you work for?

You could embed database schema and data changes into source code control by using a concept called database migrations. These can then be executed on dev and staging environments as part of a ...
  • 650
4 votes

How to change the owner of VOLUME directory in Dockerfile?

I had a similar problem, this worked for me: Write Docker file with: # Create app layer: FROM python:3.4 # Create app user & group "testuser" with IDs: RUN groupadd -r testuser --gid 1234 &&...
  • 141
4 votes

How do you limit access to the production environment in the company you work for?

I see a first problem, DevOps is about building teams able to handle an application from build to exploitation. So your devs should have access to the databases, you quoted various cases which are the ...
  • 11.1k
3 votes

Ansible tmp files created with odd permissions

The reason for the failure is that the server in question, unlike all the others, had sftp disabled. Why the error messages are what they are, I don't know (why the errant scp transfer mechanism ...
  • 313
3 votes

kubernetes: how to set "top node" and "top pod" permissions?

Thanks to arghya-sadhu's comments on stackoverflow, I've got it working: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: get-pod-and-node labels: rbac.authorization....
  • 61
3 votes
Accepted

What are the different job permissions possible in Jenkins, and what are the reasons you would use each?

There are 4 type of user permissions in Jenkins: Open Jenkins is accessible for everyone with no permissions. Basically anyone can do anything. This should be used for internal use only. User ...
  • 7,181
2 votes
Accepted

Permission errors with non-root USER when running on Linux

As described in https://github.com/docker-library/tomcat/issues/35, this is related to the storage driver used (aufs). Changing to use overlay2 solved the issue: https://docs.docker.com/storage/...
2 votes
Accepted

Using docker with users leaves files belonging to the subuid/subgid

docker run -ti --rm \ -v $PWD:/workdir \ -v $HOME/.ssh:/root/.ssh \ --user $(id -u):$(id -g) \ dockerizedxyz "$@" As long as you're not doing anything funny with the entrypoint in the ...
  • 1,355
2 votes

Assign Directory Read/Write Privileges to Azure Service Principal from the command line?

What you need here are the az ad app permission commands. Here is a complete example (assuming powershell): $apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory $...
1 vote

What are the best practices for sharing production Postgres access with developers?

We keep a RO clone of the important DB's. Any dev can access the basic RO clone if he's in the right dev group vpn, because the cloudsql instances are deployed in a private service net that peers ...
1 vote
Accepted

Docker mounts files as uid 1001

Sounds like you are using a host volume. Docker doesn't perform any uid/gid mapping on the files mounted into the container, this is how bind mounts work in Linux. On Windows and Mac, Docker Desktop ...
  • 2,840
1 vote

Docker mounts files as uid 1001

Ideally dont run docker as superuser(root). You should create a user within dockerfile and chown the file system with that user. You can create a user and then add access to that user on the file ...
1 vote
Accepted

Dockerized node.js and bind mount permission problem

In your Dockerfile: ARG UID=1000 ARG GID=1000 RUN usermod -u $UID node && groupmod -g $GID node Then using docker build: docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) . The ...
  • 556
1 vote

Is there a way to tell if an Azure Devops Extension is secure to use?

Can't comment yet, but most extensions host their source code publicly. So you could read the source code to check if something is going on that you don't want. If the source code is not available, ...
1 vote

Add permissions to readers (DevOps Web Portal)

Usually each projects would have teams defined with the team members. So if you have a team defined then add the team to the contributors list.
  • 21
1 vote

Provide customers with access to Azure Container Registry

There is a balancing act here between the simplicity and maintainability of your solution, and how auditable creating separate service principals or users for each of your external customers. I ...
1 vote

See which Roles contain a GCLOUD Permisson

Looks like only the roles/billing.admin: https://cloud.google.com/iam/docs/understanding-roles#billing-roles
  • 131
1 vote

What is the most common server permission policy for web application deployment?

I usually stick to a 755 (or rwxr-xr-x) on my web root, but I do not think this is the issue you're running into since your directory is already set to that. nginx should have access to your ...
  • 1,381
1 vote

What is the most common server permission policy for web application deployment?

According to the Nginx docs you can configure the user which runs Nginx. By default the user is nobody. You can read this Ask Ubuntu question that explains how to configure Apache2 to run as a ...
  • 918
1 vote

How do you limit access to the production environment in the company you work for?

... me and another coworker ... are the only people who have access to the production database. That's a good starting position. All too often, DBA's find themselves trying to close the stable door ...
  • 148

Only top scored, non community-wiki answers of a minimum length are eligible