How to deploy the apache server in openshift

[thincal]

when running a container which using the apache server, there are two failures happened during the apache startup:

• port issue
  (13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
  (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80
• log issue
  (13)Permission denied: AH00091: apache2: could not open error log file /var/log/apache2/error.log.

Basically it's because of the apache needs to be running as the root user, but it's running as 1001 user actually.

I am trying to avoid using the root user or fix the privilege right in openshift, so the port issue is fixed by using 8080 port, but I don't have any idea about the second log issue.

also in general, what's the solution to handle this kind of root right issue in openshift ? especially that some service such as apache needs the root right.

Thanks.

[thincal]

I know that runAsUser.Type: RunAsAny could let the container run as the root UID, but it seems that this change is applied globally, right ? If there is no other elegant way, at least let the RunAsAny only affect the specified image instead of globally. Thanks.

[vbehar]

If you want to fix the permission issue on /var/log/apache2/error.log, the best way is to chmod the /var/log/apache2 directory in your Dockerfile.
But what you should really do is log to stdout/stderr, not to log files.

You could also have a look at https://github.com/openshift/sti-php/tree/master/5.6 for an example of building an apache image.

[bparees]

+1 @vbehar

[bparees]

@smarterclayton what usability improvement do you have in mind here? we now have the crashloopbackoff messaging, right? That would seem to cover this scenario.

The only other fix i can see would be for images like this to actually work, but that's not going to happen without, at a minimum, usernamespaces, and i don't think even that would let images bind to privileged ports right?

[bparees]

i don't see any other immediate actions to take here. the options are either:

1. fix the image so it doesn't have to run as root (change the port it binds to, permissions, etc)
2. run it in an SCC that allows it to run as root.

[FantomX1-github]

I stumbled upon too many issues and restricted directories along cumbersome way of building, pushing and pulling images to see minor incremental changes, so I rather used pre-build S-2-I https://github.com/sclorg/httpd-container based on redhat, thats what worked for me (along studying its source more, issues might emerge clear what I was doing wrong)