Rootless Docker Setup

Developer help
1

Hi,

is there a way to run to run the Ghost server, database, activity pub, and analytics containers as rootless? I’m a little concerned about having this much code running as root, since an exploit to any of these components could result in a complete compromise of my system. I’m especially concerned since the Docker versions of Ghost have repeatedly been left without updates for security vulnerabilities.

I’m willing to set everything from scratch, if it means I can run Ghost and its associated services rootless. Is running Ghost in rootless containers supported?

URL: https://quinndunlap.com (behind HTTP auth while under construction)
Version: v6.21.2

  • Only modification to the default deployment is that Docker deployment is that I commented out lines associated with Caddy, since I already had a different reverse proxy set up.
  • Base OS is Arch Linux, using Docker version 29.3.0, build 5927d80c76, Docker Compose version 5.1.0.

Thank you, I appreciate any help.

1 Like
2

Ghost team is working on an official docker image which will run rootless. I think they will announce it when they think it’s ready. Here is the current version: Ghost/Dockerfile.production at main · TryGhost/Ghost · GitHub

3

Thank you, is there anywhere I can subscribe to (like a GitHub issue) to track the progress on this?

4

@ngeorger has created an alternate Docker image that runs as a “nonroot” user that I’m using.

Work is in progress to automate building new packages when Ghost makes a new release, like Docker Hub does.

Regarding the database, you can run any compatible MySQL container you like.

The analytics and ActivityPub containers I haven’t looked at.

For the analytics container, I don’t see a USER directive, but you could try using a –user flag to force a non-root user:

I don’t see a USER directive in the ActivityPub Dockerfile either:

You could also try running that with the –user flag. As those both appear to Node.js web servers, I see no reason why they couldn’t run rootless.

2 Likes
5

For the original question: As a complement of @markstos detailed answer, I also suggest running Docker itself in rootless mode. More info in Docker Docs or consider Podman instead of Docker, if you are willing to spend a little more time configuring/maintaining at the benefit of “native” or “out of the box” hardened features.

Thanks @markstos for your support with Ghost on Kubernetes

1 Like
6

Thank you for all the suggestions. I will wait for the officially supported Docker Compose version to get a rootless version. I will take a look at Podman, but it seems that some of the other software I run doesn’t have official Podman support.

7

I’m a fan of Podman– it’s what I use myself to run Ghost. But systemd doesn’t support running Podman rootless if you try to run Podman as a rootful systemd service with a User= directive. There’s an extremely long thread about problems and workarounds that people have for that:

You can run Podman as a systemd user service, which has it’s on challenges for management.

But running the container with a –user= directive or with a container that runs as non-root user internally, as Ghost-on-Kubernetes container does (and the official Ghost container reportedly will do) achieves a similar result– that the Ghost process is not running as root.

1 Like
8

I agree and I felt a bit dumb when you shared your approach with systemd units because I never thought about that method before, and it’s pretty clever.
Oftebly we forget that at the vase, containers are chroots on steroids hahaha

1 Like