Comments (6)
Heya! Can you pull the latest version of the image and let me know if that works? The scripts should no longer need write access to nginx.conf
😄
from docker-nginx-unprivileged.
Indeed, this certainly is fixed with the latest version. I should had made certain that no old images are being used before posting this issue. Oh well, happens.
Thanks for the quick reply and your help!
from docker-nginx-unprivileged.
It seems that write access is required for nginx.conf
in the latest version. I get that it's required for the scripts to modify the file, but isn't providing write access to nginx.conf
to the nginx
user technically a security risk?
That being said, I can't think of a great solution other than possible some suid hackery.
from docker-nginx-unprivileged.
Truth be told, I can't find what alleged fix was introduced to initially solve this issue, and it's been long enough that I have totally forgotten.
You are right that the image as is requires write access to nginx.conf
. This adds quite a bit of adaptability insofar as supported environments goes, and, in theory this should not be a security issue if you are running the images as intended. That being said, there might be a case for providing a less customizable and more restricted image.
from docker-nginx-unprivileged.
in theory this should not be a security issue if you are running the images as intended.
Well, even when running as intended, if an attacker discovered an exploit wouldn't it be theoretically be possible to change the config maliciously and force a reload? Or is that impossible?
from docker-nginx-unprivileged.
It would be theoretically possible, although at that stage changing the NGINX config would probably be one of your lesser worries.
But, like I said, you raise a valid point for providing a more restricted image. I don't know that it'll 100% happen, or when it will happen, if it does happen, but it's definitely an option to be explored.
In the meantime, and if it's something you'd really like to see implemented, PRs are always more than welcome!
from docker-nginx-unprivileged.
Related Issues (20)
- nginx defaults to 8080 even if we tell otherwise HOT 8
- Add `;` in readme for Line 35
- Update image to mitigate CVE-2023-44487 vulnerability HOT 3
- Improve local testing docs
- Does image build include installing security updates? HOT 1
- Add another common issue to the README section
- proxy_bind transparent whithout root user HOT 1
- Clarify how to use the different base image versions. HOT 1
- Alpine 3.19 Upgrade HOT 1
- Stable Perl images using mainline nginx? HOT 1
- Upgrade Base Image of nginxinc/docker-nginx-unprivileged from stable-bullseye to stable-bookworm HOT 6
- Container images pushed to Dockerhub are changing checksums without changing version HOT 3
- nginxplus version HOT 2
- Images with tags fixing alpine versions are missing HOT 2
- Pack and run Vue Application based on nginx-unprivileged in Kubernetes HOT 3
- CVE-2023-50387 in systemd 252.22 in nginxinc/nginx-unprivileged:latest
- Can we create environment variables and redirect to maintenance page using IF condition
- IPv6 configuration fails as checksums differ although configuration is not modified
- Vulnerability in the used Node version HOT 1
- trailing whitespace in NGINX_LOCAL_RESOLVERS output HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-nginx-unprivileged.