Azure / Azure/azure-cli

'az container exec' does NOT switch to non-root user

Open
#16,897 13 comments 0 reactions 0 assignees View on GitHub
act-observability-squad Container Instances Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Describe the bug**

I have a Docker file which ends up like:
...
USER postgres
EXPOSE 5433
VOLUME ["/var/lib/pgpro/std-13/data"]
CMD ["/opt/pgpro/std-13/bin/postmaster", "-D", "/var/lib/pgpro/std-13/data", "-c", "config_file=/var/lib/pgpro/std-13/data/postgresql.conf"]

I build a docker image based on this Docker file and start container.

If I connect to container it via 'docker' command I've successfully switched to non-root user ('postgres'):

root@ubuntu20:~/docker# docker run --rm --detach --publish 5533:5433 --name $image_id $image_id:$tag_id
025bd5c11c0e4f45ab3982de51131a605208a00caa06a50c54645c24ccc1db7a
root@ubuntu20:~/docker# docker exec --interactive --tty $image_id bash
[postgres@ ~]$ id
uid=999(postgres) gid=1000(postgres) groups=1000(postgres)
[postgres@ ~]$

The same situation if I create K8S cluster using the same docker image and run the command:
kubectl exec --stdin --tty $POD_NAME -- /bin/bash

I've automatically switched to non-root user ('postgres').

Then I create container via 'az container create ...' command using the same docker image:

az container create \
--resource-group dockers \
--name debiandocker \
--image $loginServer_id/$image_id:$tag_id \
--cpu 1 \
--memory 1 \
--registry-login-server $loginServer_id \
--registry-username pgprostdacr \
--registry-password $password_id \
--dns-name-label $image_id \
--ports 5433 \
--no-wait

If I connect to container it via 'az container exec ...' command I don't automatically switch to non-root user ('postgres'):

root@ubuntu20:~/docker# az container exec --resource-group dockers --name debiandocker --exec-command "/bin/bash" --container-name debiandocker
root@SandboxHost-637485704901527519:/# id
uid=0(root) gid=0(root) groups=0(root)

**To Reproduce**

create similar env and test the cases

**Expected behavior**

automatic switch to non-root user ('postgres') in case of 'az container exec ...' command

**Environment summary**

root@ubuntu20:~/docker# az --version
azure-cli 2.19.1

core 2.19.1
telemetry 1.0.6

Python location '/opt/az/bin/python3'
Extensions directory '/root/.azure/cliextensions'

Python (Linux) 3.6.10 (default, Feb 10 2021, 05:17:27)
[GCC 9.3.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

**Additional context**

everything worked well in summer 2020

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.