Modify /var/log/mongodb directory perms to support arbitrary user IDs

[ron1]

For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group.

Add the following to the Dockerfile to set the directory permissions for /var/log/mongodb to allow users in the root group to create files in that directory in the built image:

RUN chgrp 0 /var/log/mongodb &&
chmod g=u /var/log/mongodb

Currently, the directory is created with the following permissions:

$ ls -al /var/log/mongodb
total 0
drwxr-xr-x. 2 mongodb mongodb 6 Apr 30 19:15 .
drwxr-xr-x. 1 root root 48 Apr 30 19:15 ..
$

[yosifkit]

We do support arbitrary user and group ids when running since #81, but then permissions of the directory are left to the user. I would not recommend running processes in the root group since that will give much more access than something like the mongodb group would. Besides, most orchestration engines like Kubernetes allow you to specify the ownership/permissions of persistent volumes.

[ron1]

According to https://docs.openshift.com/container-platform/3.9/creating_images/guidelines.html:
+++++
Adding the following to your Dockerfile sets the directory and file permissions to allow users in the root group to access them in the built image:

RUN chgrp -R 0 /some/directory &&
chmod -R g=u /some/directory

Because the container user is always a member of the root group, the container user can read and write these files. The root group does not have any special permissions (unlike the root user) so there are no security concerns with this arrangement.
+++++

I'm not sure I understand your comment "I would not recommend running processes in the root group since that will give much more access than something like the mongodb group would." The above docs indicate that the container user is always a member of the root group. It also states that the root group does not have any special permissions (unlike the root user). Please clarify.

[yosifkit]

They can recommend it and that is their choice, but I am not comfortable with doing so. There are files and directories in the container that are root group owned that have greater permissions on group than that of other; this is what I mean by "more access". It may not be special access like the root user but it is still more access than the mongodb group.

The /var/log/mongodb directory is created by the MongoDB installer; this image does not use that by default and instead logs to stdout. See also #35 (comment), #90, and #103 (comment).

[ron1]

Your clarification makes perfect sense. Thanks.