/dev/std* not accessible by non-root on docker < 1.9.0 about apicast HOT 13 CLOSED

Not sure how we resolve that in V2 because we dropped dumb-init and want to run just nginx.

from apicast.

We can fix this for the master branch only, I will take a look at the possible workarounds.

from apicast.

I don't totally understand how your docker setup is/will-be, but I see https://github.com/3scale/docker-gateway/blob/v2/entrypoint.sh is still around. Are you dropping that as well?

from apicast.

All you can see in v2 branch will ne there. Entrypoint for sure.

Sent from my iPhone

On 14 Sep 2016, at 02:36, Jayen Ashar [email protected] wrote:

I don't totally understand how your docker setup is/will-be, but I see https://github.com/3scale/docker-gateway/blob/v2/entrypoint.sh is still around. Are you dropping that as well?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

from apicast.

can the workaround go in entrypoint.sh?

from apicast.

The problem is we want want another process like cat reading from fifo because that can die and will not be respawn and will become zombie and nginx logging to fifo can mean performance hit because if the fifo is not consumed fast enough it will stop reviewing traffic.
So we could just log to a file but then we would need log rotation. Really don't know what is the best option but don't see anything obvious.

Sent from my iPhone

On 14 Sep 2016, at 08:00, Jayen Ashar [email protected] wrote:

can the workaround go in entrypoint.sh?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

from apicast.

while i agree that cat dying would cause problems, would cat die in practice?

is patching nginx an option? a special access_log value that means stdout?

from apicast.

I have no idea if cat would die in practice and I don't really want to find out.
But, considering the options. If we would opt in for some workaround solution only when we detect /dev/std* is not writeable.
Then the options would be: /dev/null or fifo & cat.

We could default to /dev/null and make fifo & cat opt in on your own risk.

Wdyt?

from apicast.

as a user i'm ok with that, but it sounds like a lot of options to support and detect on your end.

from apicast.

The other option is just to pipe it to /dev/null if /dev/std* is not writeable without any option.
That would be my preferred way of doing it. Docker 1.7 is legacy and broken on many levels.

from apicast.

that's fine with me as well. even always /dev/null is fine, too.

from apicast.

Fallback to /dev/null is a good option, I will work on a fix today

from apicast.

Closed by #76. Reopen if it is still a problem on v2.

from apicast.