什么用户是在 docker 中运行的 php-fpm 还是没有 docker？

Question

RUN groupadd -g 1000 www
RUN useradd -u 1000 -ms /bin/bash -g www www
COPY . /var/www
COPY --chown=www:www . /var/www
USER www

In dockerfile, I got this.

My question is: how to check which user is running under php-fpm container? In nginx, if I want to find that out, I check /etc/nginx/nginx.conf file and there's user written there. but for php-fpm I can't figure out. How do I figure out? Don't tell me to use whoami or things like that as this is the user that is currently logged in.

The command I showed you above (i don't know how it does) but it makes www user and www group and gives this user and group to all my files and directories. then sets the USER which will be logged in. but I don't know how 'write' permission works, as folders have rwxr-xr-x. this means that php-fpm is running under www. We never changed which user is running under php-fpm and how does it happen? Can someone explain that to me?

Answer 1

Docker is in isolation technology, but you still can use ps -ef and so on, so just run

docker exec -it ${container} ps -ef 

and it will return the list of active processes and their owners.

For example simple php:8-fpm shows:

UID          PID    PPID  C STIME TTY          TIME CMD
root           1       0  0 05:16 ?        00:00:00 php-fpm: master 
process (/usr/local/etc/php-fpm.conf)
www-data       7       1  0 05:16 ?        00:00:00 php-fpm: pool www
www-data       8       1  0 05:16 ?        00:00:00 php-fpm: pool www

Next just find the user in the /etc/passwd

docker exec -it ${container} grep 'www-data' /etc/passwd

It will show

www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

So it's definitely www-data with uid 33.

If the container doesn't have ps inside, you have 2 options, you can install it, or find uid manually

For install use this command (example is for php:8-fpm ):

docker exec -it -u 0 ${container} su -c "apt update -y && apt install procps -y"

For manual search just grep /proc

sudo docker exec -it ${container} ls -ln /proc/

php:8-fpm as other containers run a forked process as non-root, so the user won't be 0, in this case, 33

Answer 2

USER www changes the user the container runs as to www . If php-fpm is run as non-root then it will ignore the user and group directives for the pool config and run instead as the current user. Those directives only apply if php-fpm is run as root.

The standard php-fpm docker container runs as root but has the pool configured to for www-data .