Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support none root deployment #3000

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

TommyLike
Copy link
Contributor

@TommyLike TommyLike commented Jan 7, 2024

Description

Support build and deploy dragonfly within none root user.

  1. Create dragonfly user and group in base/manager/scheduler/dfdaemon/trainer image
  2. Use none root user in docker compose yaml
  3. Add dataDir config option for manager, which is used for overwrite the default value
  4. Update several path for docker compose configuration

Related Issue

Motivation and Context

For security concern, it's better to have process running within none root user.

Screenshots (if appropriate)

Not fully understand the whole picture of draognfly and within this update the seed peer will take several minutes to become ready

2024-01-07T09:51:26.533Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:26Z", "grpc.request.deadline": "2024-01-07T09:51:27Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.056}
2024-01-07T09:51:27.652Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:27Z", "grpc.request.deadline": "2024-01-07T09:51:28Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.021}
2024-01-07T09:51:28.782Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:28Z", "grpc.request.deadline": "2024-01-07T09:51:29Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.036}
2024-01-07T09:51:29.923Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:29Z", "grpc.request.deadline": "2024-01-07T09:51:30Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.095}
2024-01-07T09:51:31.097Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:31Z", "grpc.request.deadline": "2024-01-07T09:51:32Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.068}
2024-01-07T09:51:32.215Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:32Z", "grpc.request.deadline": "2024-01-07T09:51:33Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.158}
2024-01-07T09:51:33.367Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:33Z", "grpc.request.deadline": "2024-01-07T09:51:34Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.04}
2024-01-07T09:51:33.759Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:33Z", "grpc.request.deadline": "2024-01-07T09:51:35Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.038}
2024-01-07T09:51:33.767Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:33Z", "grpc.request.deadline": "2024-01-07T09:51:35Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.024}
2024-01-07T09:51:33.772Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:33Z", "grpc.request.deadline": "2024-01-07T09:51:35Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.056}
2024-01-07T09:51:33.778Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:33Z", "grpc.request.deadline": "2024-01-07T09:51:35Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.028}
2024-01-07T09:51:34.465Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:34Z", "grpc.request.deadline": "2024-01-07T09:51:35Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.165}
2024-01-07T09:51:35.580Z	INFO	zap/server_interceptors.go:39	finished unary call with code OK	{"grpc.start_time": "2024-01-07T09:51:35Z", "grpc.request.deadline": "2024-01-07T09:51:36Z", "system": "grpc", "span.kind": "server", "grpc.service": "grpc.health.v1.Health", "grpc.method": "Check", "grpc.code": "OK", "grpc.time_ms": 0.022}
2024-01-07T09:51:35.801Z	ERROR	grpclog/grpclog.go:55	[scheduler_resolver]resolve addresses error schedulers not found
google.golang.org/grpc/internal/grpclog.ErrorDepth
	/go/pkg/mod/google.golang.org/[email protected]/internal/grpclog/grpclog.go:55
google.golang.org/grpc/grpclog.(*componentData).ErrorDepth
	/go/pkg/mod/google.golang.org/[email protected]/grpclog/component.go:46
google.golang.org/grpc/grpclog.(*componentData).Errorf
	/go/pkg/mod/google.golang.org/[email protected]/grpclog/component.go:79
d7y.io/dragonfly/v2/pkg/resolver.(*SchedulerResolver).ResolveNow
	/go/src/d7y.io/dragonfly/v2/pkg/resolver/scheduler_resolver.go:84
d7y.io/dragonfly/v2/pkg/resolver.(*SchedulerResolver).OnNotify
	/go/src/d7y.io/dragonfly/v2/pkg/resolver/scheduler_resolver.go:109
d7y.io/dragonfly/v2/client/config.(*dynconfigManager).Notify
	/go/src/d7y.io/dragonfly/v2/client/config/dynconfig_manager.go:242
d7y.io/dragonfly/v2/client/config.(*dynconfigManager).Serve
	/go/src/d7y.io/dragonfly/v2/client/config/dynconfig_manager.go:268
d7y.io/dragonfly/v2/client/daemon.(*clientDaemon).Serve.func10
	/go/src/d7y.io/dragonfly/v2/client/daemon/daemon.go:744
golang.org/x/sync/errgroup.(*Group).Go.func1
	/go/pkg/mod/golang.org/x/[email protected]/errgroup/errgroup.go:75

Status after 10 minutes of docker compose, the seed peer finally turns into ready.
image

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation Update (if none of the other choices apply)

Checklist

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.

@TommyLike TommyLike requested a review from a team as a code owner January 7, 2024 08:59
Copy link

codecov bot commented Jan 7, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (1e39879) 51.45% compared to head (cc02ac6) 51.41%.
Report is 6 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3000      +/-   ##
==========================================
- Coverage   51.45%   51.41%   -0.05%     
==========================================
  Files         162      162              
  Lines       22171    22147      -24     
==========================================
- Hits        11408    11386      -22     
+ Misses      10105    10103       -2     
  Partials      658      658              
Flag Coverage Δ
Object-compatibility-e2etests ?
e2etests ?
unittests 51.41% <ø> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
manager/config/config.go 96.56% <ø> (ø)

... and 7 files with indirect coverage changes

@TommyLike TommyLike force-pushed the bug/support-none-root-deployment branch from 10e9e32 to 0bd9ed0 Compare January 7, 2024 09:50
@@ -29,11 +29,28 @@ RUN if [ "$(uname -m)" = "ppc64le" ]; then \

FROM ${BASE_IMAGE}

ARG USER_NAME=dragonfly
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the default user should be root, please do not to break compatibility with previous versions of dragonfly.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the code only adds the none root user and group, the default user is still root.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do not change the default root user using command.

Copy link
Contributor Author

@TommyLike TommyLike Jan 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do not change the default root user using command.

If I understand correctly

  1. the default user when running container is still root and we can use the dragonfly user by adding user argument
  2. the binary would belongs to dragonfly/dragonfly can it can still work within root user.

ARG USER_UID=1000
ARG GROUP_NAME=dragonfly
ARG GROUP_GID=1000
RUN groupadd -g $GROUP_GID $GROUP_NAME && useradd -u $USER_UID -g $GROUP_GID -m -s /bin/bash $USER_NAME
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove blank line.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure

deploy/docker-compose/template/dfget.template.yaml Outdated Show resolved Hide resolved
deploy/docker-compose/template/dfget.template.yaml Outdated Show resolved Hide resolved
@@ -29,11 +29,28 @@ RUN if [ "$(uname -m)" = "ppc64le" ]; then \

FROM ${BASE_IMAGE}

ARG USER_NAME=dragonfly
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do not change the default root user using command.

@TommyLike TommyLike force-pushed the bug/support-none-root-deployment branch from 8e26328 to de37a1b Compare January 10, 2024 01:07
@TommyLike
Copy link
Contributor Author

@gaius-qi updated as comments

@TommyLike TommyLike force-pushed the bug/support-none-root-deployment branch from de37a1b to cc02ac6 Compare January 10, 2024 01:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants