non-root start for nginx or rserver process
Nobody has claimed this yet.
- Dominant language
- Markdown
- Stars
- 46
- Forks
- 40
- Avg merge
- 4h 3m
- Merged PRs (30d)
- 6
Description
Hello
So I was thinking about the fact that the rserver-http which is based on nginx listens on port 8787 but runs as root. I havent find any way of running the rserver-http as non-root only, not even for the main workbench process rserver. I have tried running the rserver process as non-root by modifying the startup.sh file but that comes with other errors such as pam sessions not working and rstudio-launcher throwing these messages:
2024-05-30T14:20:34.863624Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:35.390795Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:36.396094Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:38.400983Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.407444Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.462144Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.574728Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.866322Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:43.461626Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:46.463619Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:47.414316Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:47.465908Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:49.461432Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:52.465742Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:52.465751Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
Is there a way to make the rserver-http process start as non-root? or even the rserver process? what configurations are needed?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the modified startup.sh and the rstudio-launcher authorization errors shown in the report first. Determine whether the Helm resources expose configuration for running rserver-http or rserver without root, including the PAM and launcher effects; done means the supported configuration and required changes are documented or the limitation is clearly recorded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, nginx
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 22/100