Repository navigation
support for OpenShift/documentaton #162
Description
Hello,
Any documentations for running this on OCP, on installing on OCP , the pod fails with the error
Error: Can't drop privilege as nonroot user
For help, use /usr/bin/supervisord -h
I believe this is because OCP is restricted and doesnt allow privileged containers, even after allowing the privilege SCC to the service account, it fails.
Thanks in advance
Activity
cfis commentedon Apr 24, 2025
Hmm, the security context is here:
https://github.com/docker-mailserver/docker-mailserver-helm/blob/master/charts/docker-mailserver/values.yaml#L224C2-L227C1
So in theory the container should not be run with root user, but I just checked and it is. Not sure why - would have to investigate.
Anyway, not sure if docker-mailerserver itself works without root access, but it would certainly be better if it did. Happy to take a PR if you want to play around with this.
cfis commentedon Apr 29, 2025
See #164 (comment).
Guessing this likely won't work. In addition, the security context settings don't work according to this report - #163.
polarathene commentedon Apr 29, 2025
You can run it rootless AFAIK, which keeps the container internally running as root UID 0, but on the host it's mapped to a range above 2^16, thus if escaped is not actually the root user. My rootless experience is a bit limited, I think besides the
/etc/subuidassignment one container UID can be mapped to the non-root user on the host.Running as a non-root user in the container however in both rootful/rootless containers is not going to work.