在 Docker 映像中以非 root 用户身份运行 cronjob 的正确方法是什么？

Question

It's been a really long time since I've posted something here. I've been struggling with this for a while now and thought it would be the perfect time to come here.

I need a container image that would execute a cron job. The issue is that I need to run the container as a non-root user due to security reasons and best practices; however, the default crond (busybox) won't execute as a non root. Therefore, I decided to use dcron , which is a lightweight cron daemon.

Dockerfile:

FROM alpine:3.12.1
RUN apk --no-cache add dcron

RUN adduser -S 11111 -u 11111 -G cron -s /bin/ash && \
    chgrp cron /usr/sbin/crond && \
    chmod 4770 /usr/sbin/crond

RUN echo "* * * * * date >> /tmp/log/test 2>&1" >> /etc/crontabs/11111
RUN chown 11111 /etc/crontabs/11111

USER 11111

CMD ["crond", "-f"]

Problem:

When I run this container, I get the following output: setpgid: Operation not permitted .

Interestingly though, if I omit the CMD from the Dockerfile and run crond -f inside the shell it will work just fine!

Any suggestions would be highly appreciated!

Answer 1

So after some investigation, I ended up not using cron at all and doing something simple instead. Not an ideal solution, but does what I need at the moment. I am going to share it here, but please do share a proper way to solve this if you know. For example, with the following a 'job' will run every 12 hours:

Dockerfile:

FROM alpine:3.12.1

COPY  entrypoint.sh /usr/local/bin
RUN chmod +x /usr/local/bin/entrypoint.sh

ENTRYPOINT ["entrypoint.sh"]

entrypoint.sh

#!/usr/bin/env ash

while true; do
  echo "$(date) Hello there!"
  sleep "12h"
done

Additional information

Some other solutions that you might find interesting:

1. https://github.com/aptible/supercronic/
2. https://hub.docker.com/r/blacklabelops/logrotate https://github.com/blacklabelops/logrotate
3. https://medium.com/@geekidea_81313/running-cron-jobs-as-non-root-on-alpine-linux-e5fa94827c34

Some of the suggestions like (3) didn't work, and (1,2) were a little too complex for what I needed.

Answer 2

If your docker container is running as non root user, you cannot start the cron daemon as it requires root privilege to start.

It is worth to explore https://github.com/aptible/supercronic/ which gives you similar set of cron that can be run without root user privileges and it is equivalent to cron.

Build from Source:

go get -d github.com/aptible/supercronic
cd "${GOPATH}/src/github.com/aptible/supercronic"
go mod vendor
go install

Download Binaries:

https://github.com/aptible/supercronic/releases

To better performance, you can store the binaries in antifactory and read using docker build.

Hack

You can cross build and generate the binaries.