Skip to content

Add option to not override nginx user#359

Closed
giladd123 wants to merge 1 commit intoBorisPolonsky:masterfrom
giladd123:nginx-default-user
Closed

Add option to not override nginx user#359
giladd123 wants to merge 1 commit intoBorisPolonsky:masterfrom
giladd123:nginx-default-user

Conversation

@giladd123
Copy link
Copy Markdown
Contributor

In nginx, the user directive can only be used when the process is started with the root user, which creates issues when trying to run the proxy in a non-root environment.

The changes presented add the option to not set the directive, while preserving the default behavior of it being included.

@BorisPolonsky
Copy link
Copy Markdown
Owner

BorisPolonsky commented Dec 25, 2025

Declaring user nginx; alone in nginx.conf won't suffice for non-root nginx setup as the ownership related directories (e.g. /etc/nginx, /var/cache/nginx/) would need further adjustment. It would be better to automatically determine from security context.
We'll consider a self-sufficient solution for non-root setups of nginx, taking account this issue, #361 and further adjustments if required as well.

@giladd123
Copy link
Copy Markdown
Contributor Author

You're right, removing the declaration alone won't suffice, but if we include #360 we can mount two emptyDir volumes in /var/cache/nginx and /var/run, which does work as a workaround (nginx only needs read permissions on /etc/nginx).

I can work on a more comprehensive solution, but please keep in mind that the 3 PRs I've created do solve the issue while not changing expected behavior.

@BorisPolonsky
Copy link
Copy Markdown
Owner

Declaring user nginx; alone in nginx.conf won't suffice for non-root nginx setup as the ownership related directories (e.g. /etc/nginx, /var/cache/nginx/) would need further adjustment. It would be better to automatically determine from security context. We'll consider a self-sufficient solution for non-root setups of nginx, taking account this issue, #361 and further adjustments if required as well.

Closing this issue as we've integrated this option in #363. Note that we still need #361 and #360 for the whole solution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants