Bug: kitchenowl-web fails to start without root privileges about kitchenowl HOT 7 CLOSED

Yes, I'll add the plain html files to the next release and provide some instructions on how to setup nginx for it to work.

from kitchenowl.

Great to hear that!

Since the kitchenowl-web is only an nginx serving a statically build web site (generated from dart, I guess), could you also release the static web app so that people who already have nginx or similar running, can simply serve the files without needing to start a second nginx? Does not seem like much, but it adds up if you run a dozen selfhosted services doing exactly that (and your hosting on a small low-RAM VPS or RaspberryPI-like device)

The backend runs just fine in user mode.

from kitchenowl.

Published a new stable release that should fix this issue.
Because you also asked for a sample nginx configuration to host the static files yourself that can be found here: https://github.com/TomBursch/kitchenowl/blob/main/default.conf.template

See https://tombursch.github.io/kitchenowl/get-started/ for the new default setup (just remove FRONT_URL everywhere)

from kitchenowl.

Which OS and distro is this running on? What command did you run to start the container? Did you install rootless docker for this and if so how?

You will certainly need root inside the container to be able to write to /var, so you would need user namespaces enabled (if this is Linux) and rootless docker installed.

from kitchenowl.

Thanks for the quick reply. It's Ubuntu 22.04, started as docker compose up -d. I am not using rootless docker.

Imho, the service should not require root inside the container to run. Writing into the container is not really considered good practice. If it is inevitable to start the container with root, it should provide some form of privilege lowering. Running internet-facing services as root (even inside a container) is far from optimal :-)

from kitchenowl.

I agree that it's better for overall security to run nginx in user mode, even in the container. Like you can see in the logs, I'm writing some environment variables to a .env file, this is was needed in the beginning because the setup was a bit different to what it is now. I already looked into ways of removing it, which would also get rid of the front_url variable so many people have problems with.

I can see that you're also running the backend in user mode, did you have any problems with that?

from kitchenowl.

#58

from kitchenowl.