Hot answers tagged

9

AFAIK Linux only has the concept privileged ports versus unprivileged ports. The Linux kernel tuning parameter net.ipv4.ip_unprivileged_port_start defines which ports are privileged. All ports between 0 and net.ipv4.ip_unprivileged_port_start are privileged. Privileged ports can only used by processes either started by the root user or with root privileges ...


6

First of all, only trusted users should be allowed to control your Docker daemon The docker daemon runs as root by default on a Debian Bullseye installation. Adding a user to the docker group gives that user psuedo root access due to having control of the docker daemon having that amount of access. Every user in the docker group will have complete control ...


5

As long as the ports are unprivileged, non-root users can bind to any port (over 1024). They can start the containers with: docker run --expose 1300-1350 <image-name> It is first come first served. If two programs are trying to bind to the same port, only the first one to bind will succeed. For privileged ports (less than 1024), you need either root ...


3

The subdomains are reversed proxied using nginx to a specific port. You can proxy the subdomains to Unix sockets. proxy_pass http://unix:/var/run/anna.sock:/; Repeat as needed for each subdomain, and set the permissions on the Unix sockets so that only the users you want can listen there. Also note that a user who can run Docker containers can mount /...


1

You can use the ${APACHE_DOCUMENT_ROOT} notation in the Apache config file. I took the example from this unanswered question: <VirtualHost _default_:80> ServerSignature Off ErrorLog ${APACHE_LOG_DIR}/000-default-error.log CustomLog ${APACHE_LOG_DIR}/000-default-access.log combined DocumentRoot ${APACHE_DOCUMENT_ROOT} <Directory ${...


1

Best I've found for this so far... Thanks for the comment from @Tim, CodeBuild runs on ECS. When it does that, it pulls credentials from container credentials. Those are apparently pulled from a different IP address, which can be accessed via 169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI You can extract the role credentials from that call and then ...


1

This means that the RDB database is corrupted. You should stop the container and restore the file from a backup. If you can't restore it, you can rename/move it to have a corrupted backup in case you want to restore it partially, then start the redis container. If this is happening often, check if AOF (Append Only File) is better for you. You can have both ...


1

Is it ok to use Nginx in the host which will forward traffic to multiple different dockerized Nginx? Yes. This is one way to do it. Does it have any known problems? The host instance of NGINX is not containerised which may make it more difficult to configure. Another common way to do this is to have a docker container bound to port 80 and 443 which handles ...


1

Is it ok to use Nginx in the host which will forward traffic to multiple different dockerized Nginx? Yup, it's actually a common practice. Does it have any known problems? Caused by this setup itself - nope. Will that affect performance? In a way - sure: like every other load balancer (which it is) it will add some delay on buffering and TCP sockets.


1

You are mapping Port 80 to the port 8000 in your docker-compose.yml. Your requests never reach nginx. ports: - "80:80" - "443:443"


1

As is usually the case, when I'm working in something new, and I don't see what I expect, I was looking in the wrong place. The .yaml file I created while following the tutorial created a deployment and because the .yaml specified a single replica it created a single pod. If I set "replicas: 2" I see two pods. And if I click the hamburger icon on a ...


1

Traefik doesn't know which IP of the container it should try to connect. You're close with traefik.docker.network=web but that's not really the name of the network. The network will get a prefix for the project or stack name. To hard code the network name, you can use the name field in the final network section (this is specific to version 3.5 or newer): ...


1

If you push an image to ECR you are no longer relying on the "first layer" of your dockerfile for the image you built. If you have a Dockerfile that has a FROM that points to mcr.microsoft.com/dotnet/framework/aspnet:4.8-windowsservercore-ltsc2016 and you build an image off of this Dockerfile, you can push to ECR and you are no longer dependent on ...


1

According to Rancher "If you want to use Google Container Registry, you will have to use a service account JSON key file. Don’t forget to grant the correct permissions to the Google Cloud Storage bucket containing your Container Registry images. Specify the registry address according to the region your images are stored. Use _json_key as username and ...


1

Try setting Site Address and WordPress Address . Go to Settings >> General Set WordPress Address (URL) and Site Address using your fqdn Reference For more oficial information: WordPress Doc


1

One can connect to the container by using host A as the jump host. However, this requires a user-account on host A for this purpose. One can limit the jump host account so that there is no access to the server itself. The limitation can be done in host A sshd_config. Match user bob X11Forwarding no AllowTcpForwarding ForceCommand ssh bob@<...


1

By default docker binds mapped ports to 0.0.0.0, which exposes it to all interfaces. If you don't want that, you can bind it to the local interface only. docker run -p 127.0.0.1:8080:80 httpd


1

Just wanted to add another perspective...certainly more work! But interesting... Consider running a container orchestrator, such as Kubernetes. Check out KIND (Kubernetes-in-Docker) for an interesting way to run a Kubernetes cluster on a single node with only Docker. You could then, for example, do something like create a namespace for each user, such as ...


Only top voted, non community-wiki answers of a minimum length are eligible