rstudio / rstudio/helm

non-root start for nginx or rserver process

Open
#519 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

team: workbench
Dominant language
Markdown
Stars
46
Forks
40
Avg merge
4h 3m
Merged PRs (30d)
6

Description

Hello
So I was thinking about the fact that the rserver-http which is based on nginx listens on port 8787 but runs as root. I havent find any way of running the rserver-http as non-root only, not even for the main workbench process rserver. I have tried running the rserver process as non-root by modifying the startup.sh file but that comes with other errors such as pam sessions not working and rstudio-launcher throwing these messages:

2024-05-30T14:20:34.863624Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:35.390795Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:36.396094Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:38.400983Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.407444Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.462144Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.574728Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:42.866322Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:43.461626Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:46.463619Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:47.414316Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:47.465908Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:49.461432Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:52.465742Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/jobs?fields=Status,tags&status=Pending|Running]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373
2024-05-30T14:20:52.465751Z [rstudio-launcher] ERROR No authorization provided for request [requestMethod: GET, requestUri: /v1/user]; LOGGED FROM: void rstudio::job_launcher::Server::onApiRequest(rstudio_boost::shared_ptr<rstudio::core::http::AsyncConnection>) src/cpp/job_launcher/LauncherServer.cpp:373

Is there a way to make the rserver-http process start as non-root? or even the rserver process? what configurations are needed?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the modified startup.sh and the rstudio-launcher authorization errors shown in the report first. Determine whether the Helm resources expose configuration for running rserver-http or rserver without root, including the PAM and launcher effects; done means the supported configuration and required changes are documented or the limitation is clearly recorded.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, nginx
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
22/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.