influxdata / influxdata/influxdata-docker

Telegraf docker entrypoint script change needed to support deployment from compose script

Open
#734 2 comments 0 reactions 0 assignees View on GitHub
telegraf
Dominant language
Shell
Stars
364
Forks
255
Avg merge
3h 18m
Merged PRs (30d)
7

Description

Referencing #724 and #543 I was still having problems with a specific line in the [entrypoint script](https://github.com/influxdata/influxdata-docker/blob/0f0bdbbb22b44e9a5953b0f733d6992ade4d7c55/telegraf/1.30/entrypoint.sh#L21)

The line currently reads:

`extra_groups="$(id -Gn || true)"`

This script doesn't honor UID; rather, if the UID is 0 (root) it just executes as the 'telegraf' user. Unfortunately, if you are root, that id will get the groups associated with root, not telegraf. I think it needs to be changed to:

`extra_groups="$(id -Gn telegraf || true)"`

With this change, I can specify a service in a compose file:

```
services:
telegraf:
image: mystack/telegraf
container_name: telegraf
volumes:
- type: bind
source: /etc/telegraf
target: /etc/telegraf
read_only: true
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
build:
context: telegraf
```

I made this change with a custom entrypoint to test it:

```
FROM docker.io/telegraf
RUN groupadd -r docker -g 122
RUN usermod -aG docker telegraf
COPY custom-entrypoint.sh /custom-entrypoint.sh
RUN chmod +x /custom-entrypoint.sh
ENTRYPOINT ["/custom-entrypoint.sh"]
CMD ["telegraf"]
```
and that makes it work.

I think there's about a million ways to solve this problem. I think, though, that the structure of the script really intends to just exec if the uid is not 0, and if the uid is 0 it intends to force you to the 'telegraf' user - that's a strategy and it's fine and reasonably secure, but that `id -Gn` is going to check the extra groups of user 0, come up with only "root" then promptly remove that group.

If anybody agrees, please respond - I'll happily submit a pull request for this. Or, if you've got another way to pair docker compose + docker build and make this work, that's fine too. Me having to create a custom entrypoint doesn't seem like the right solution unless I'm the only person still having this problem.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with telegraf/1.30/entrypoint.sh at line 21 and inspect how its group lookup behaves when the container starts as root before switching to telegraf. Reproduce the Docker Compose bind-mount scenario from the issue and confirm that the entrypoint preserves the telegraf user's extra group access.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
devops, infrastructure
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.