[
https://issues.apache.org/jira/browse/GUACAMOLE-890?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17026941#comment-17026941
]
Mark Nolan commented on GUACAMOLE-890:
--------------------------------------
OK, digging further, we may be running with the wrong tomcat image.
If I follow things correctly, we are running with 8.5-jre8:
{code:java}
ARG TOMCAT_VERSION=8.5
ARG TOMCAT_JRE=jre8
...
# For the runtime image, we start with the official Tomcat distribution
FROM tomcat:${TOMCAT_VERSION}-${TOMCAT_JRE}
{code}
However, looking here [https://hub.docker.com/_/tomcat], that is not a
supported tag. I believe it should be 8.5-jdk8. And looking at the build report
for the issues I listed earlier, it seems to confirm that.
It seems that the jre8 tag was updated 8 months ago whereas the jdk8 tag was
updated 8 days ago, so I assume jre8 is obsolete.
> Guacamole/Guacd Docker Process Privilege Drop
> ---------------------------------------------
>
> Key: GUACAMOLE-890
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-890
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole-docker
> Reporter: Anthony Boccia
> Priority: Minor
> Labels: docker, security
>
> Hello,
> I noticed after deploying Guacamole in docker that the processes all run as
> the root user. Are there any plans to add support for specifying a user for
> the processes to drop privs to and run as instead of root? I am currently
> doing this rebuilding the containers for guacamole and guacd adding in my own
> user and using docker compose to exec all processes triggered within the
> container as that user. I feel like the option to specify this should be done
> upstream.
> Thank You
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
