Allow running as arbitrary UID for unprivileged Container Environments (OpenShift)
Open
@julianbrost is already working on this.
Since Aug 26, 2025.
- Dominant language
- C++
- Stars
- 2.2k
- Forks
- 616
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 10
Description
Is your feature request related to a problem? Please describe.
In order to be able to run Icinga in a context with indeterminate User IDs, such as OpenShift, the group-injection logic from icinga.cpp seems to be an obstacle:
if (!pw) {
if (errno == 0) {
Log(LogCritical, "cli")
<< "Invalid user specified: " << user;
return EXIT_FAILURE;
} else {
Log(LogCritical, "cli")
<< "getpwnam() failed with error code " << errno << ", \"" << Utility::FormatErrorNumber(errno) << "\"";
return EXIT_FAILURE;
}
}
// also activate the additional groups the configured user is member of
...
Describe the solution you'd like
From my testing, activating additional groups in such a context is superfluous, since there are none; since the process is run as an arbitrary UID with GID 0, removing the if (!pw) { check and instead wrapping the group activating logic in
if (pw) {
// also activate the additional groups the configured user is member of
...
}
works fine
Describe alternatives you've considered
I've considered wrapping the image with dynamic user and group renaming, but this adds unnecessary complexity and image layers
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.