influxdata / influxdata/influxdata-docker
Telegraf docker entrypoint script change needed to support deployment from compose script
- Dominant language
- Shell
- Stars
- 364
- Forks
- 255
- Avg merge
- 3h 18m
- Merged PRs (30d)
- 7
Description
Referencing #724 and #543 I was still having problems with a specific line in the [entrypoint script](https://github.com/influxdata/influxdata-docker/blob/0f0bdbbb22b44e9a5953b0f733d6992ade4d7c55/telegraf/1.30/entrypoint.sh#L21)
The line currently reads:
`extra_groups="$(id -Gn || true)"`
This script doesn't honor UID; rather, if the UID is 0 (root) it just executes as the 'telegraf' user. Unfortunately, if you are root, that id will get the groups associated with root, not telegraf. I think it needs to be changed to:
`extra_groups="$(id -Gn telegraf || true)"`
With this change, I can specify a service in a compose file:
```
services:
telegraf:
image: mystack/telegraf
container_name: telegraf
volumes:
- type: bind
source: /etc/telegraf
target: /etc/telegraf
read_only: true
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
build:
context: telegraf
```
I made this change with a custom entrypoint to test it:
```
FROM docker.io/telegraf
RUN groupadd -r docker -g 122
RUN usermod -aG docker telegraf
COPY custom-entrypoint.sh /custom-entrypoint.sh
RUN chmod +x /custom-entrypoint.sh
ENTRYPOINT ["/custom-entrypoint.sh"]
CMD ["telegraf"]
```
and that makes it work.
I think there's about a million ways to solve this problem. I think, though, that the structure of the script really intends to just exec if the uid is not 0, and if the uid is 0 it intends to force you to the 'telegraf' user - that's a strategy and it's fine and reasonably secure, but that `id -Gn` is going to check the extra groups of user 0, come up with only "root" then promptly remove that group.
If anybody agrees, please respond - I'll happily submit a pull request for this. Or, if you've got another way to pair docker compose + docker build and make this work, that's fine too. Me having to create a custom entrypoint doesn't seem like the right solution unless I'm the only person still having this problem.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with telegraf/1.30/entrypoint.sh at line 21 and inspect how its group lookup behaves when the container starts as root before switching to telegraf. Reproduce the Docker Compose bind-mount scenario from the issue and confirm that the entrypoint preserves the telegraf user's extra group access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100