Docker container does not run with a non-root user - docker

Question

FROM ubuntu:18.04
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -yq --no-install-recommends \
apt-utils \
curl \
# Install git
git \
# Install apache
apache2 \
# Install php 7.2
libapache2-mod-php7.2 \
php7.2-cli \
php7.2-json \
php7.2-curl \
php7.2-fpm \
php7.2-gd \
php7.2-ldap \
php7.2-mbstring \
php7.2-mysql \
php7.2-soap \
php7.2-sqlite3 \
php7.2-xml \
php7.2-zip \
php7.2-intl \
php-imagick \
# Install tools
openssl \
nano \
graphicsmagick \
imagemagick \
ghostscript \
mysql-client \
iputils-ping \
locales \
sqlite3 \
ca-certificates \
&& apt-get clean && rm -f /var/www/html/index.html && rm -rf /var/lib/apt/lists/**
ENV LANG en_US.utf8
RUN groupadd --gid 5000 newuser \
&& useradd --home-dir /home/newuser --create-home --uid 5000 \
--gid 5000 --shell /bin/sh --skel /dev/null newuser
WORKDIR /var/www/html
COPY index.php /var/www/html
EXPOSE 80
HEALTHCHECK --interval=5s --timeout=3s --retries=3 CMD curl -f http://localhost || exit 1
CMD ["apachectl", "-D", "FOREGROUND"]
USER newuser
The error I get:
(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80 no listening sockets available, shutting down AH00015: Unable to open logs Action '-D FOREGROUND' failed. The Apache error log may have more information.

Answer 1

As #Henry wrote:
A non root user cannot bind to ports below 1024. Use a port that is higher e.g. 8080.
I suggest you change apache port and, if you need to access apache from the host, map the port 8080 to 80 in docker.
e.g.
docker build -t myapacheimg .
docker run -it --rm -p 8080:80 myapacheimg
In order to have this stuff working you need to perform the following operations:
change the ports in the /etc/apache2/ports.conf
change the virtualhost in the /etc/apache2/sites-enabled/000-default.conf
change the ownership of the /var/log/apache2 and /var/run/apache2 folders
In other words, here's an excerpt of the Dockerfile:
...
&& apt-get clean && rm -f /var/www/html/index.html && rm -rf /var/lib/apt/lists/**
COPY ./ports.conf /etc/apache2/ports.conf
COPY ./000-default.conf /etc/apache2/sites-enabled/000-default.conf
ENV LANG en_US.utf8
RUN groupadd --gid 5000 newuser \
&& useradd --home-dir /home/newuser --create-home --uid 5000 \
--gid 5000 --shell /bin/sh --skel /dev/null newuser
RUN chown -R newuser /var/log/apache2 /var/run/apache2
...
ports.conf
Listen 8080
000-default.conf:
<VirtualHost *:8080>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
IMHO this is an ugly solution. I'd use the docker image php:7.2-apache and avoid all these problems.

Answer 2

A non root user cannot bind to ports below 1024. Use a port that is higher e.g. 8080.

Answer 3

It can be done without changing the port also, using the setcap command to modify the linux capability.
For example, If you wish to use the default port 80 for apache2 then your Dockerfile will look something like this:
[...]
RUN apt-get update \
&& apt-get install -y libcap2-bin \
&& setcap 'cap_net_bind_service=+ep' /usr/sbin/apache2 \
&& chown www-data:www-data /var/log/apache2
USER www-data
[...]