Db2

 View Only
Expand all | Collapse all

The need for a non privileged and non root Db2 Community docker image

  • 1.  The need for a non privileged and non root Db2 Community docker image

    Posted 4 days ago

    Hi,

    The current Db2 Community docker image only runs with root user and, according to the documentation, it requires "privileged" mode:

    docker run -itd --name mydb2 --privileged=true -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=<choose an instance password> -e DBNAME=testdb -v <db storage dir>:/database ibmcom/db2

    Due to new enterprise security policies, we must run containers as non root users and "privileged" mode is forbidden. When I try to run this image with "--user 1000", I get the following error:

    $ docker run --rm --user 1000 --name mydb2 -p 50000:50000 -e LICENSE=accept -e DB2INST1_PASSWORD=pass -e DBNAME=testdb
    -v $PWD/data:/database ibmcom/db2
    id: cannot find name for user ID 1000
    id: cannot find name for user ID 1000
    id: cannot find name for user ID 1000
    (*) Previous setup has not been detected. Creating the users...
    (*) Creating users ...
    groupadd: Permission denied.
    groupadd: cannot lock /etc/group; try again later.
    groupadd: Permission denied.
    groupadd: cannot lock /etc/group; try again later.
    (*) Creating instance ...
    /var/db2_setup/include/db2_common_functions: line 51: /opt/ibm/db2/V11.5/instance/db2icrt: Permission denied
    (!) There was a problem configuring the instance. Copying over logs and traces to /database/config ...
    cp: cannot stat '/tmp/*db2*': No such file or directory
    db2support: Cannot determine userid

    Would it be possible to make this image non root and non privileged?

    Context: we use this image on our CI/CD pipeline to run tests on applications that access Db2 on production. This CI/CD pipeline is ran on a OpenShift cluster.



    ------------------------------
    Rodrigo Carvalho Silva
    ------------------------------