Frido pointed out that koha-worker will run as root in a package install because we haven't specified a lower privileged Koha-specific user. See https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363#c32.
And I just remembered that we can't securely use systemd in a container, and trying to do so for testing purposes is challenging as well.
Created attachment 117552 [details] [review] Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha
Here are some instructions on how to create a koha-testing-docker container with Systemd using Docker: Systemd in container (insecurely): 0. Build an image FROM koha/koha-testing:master 1. Install systemd and systemd-sysv 2. CMD ["/sbin/init"] 3. Update your docker-compose file to use this new systemd image for koha container 4. Update your docker-compose file to use "privileged: true" to the koha container 5. Enter into the koha container and run /kohadevbox/run.sh by hand 6. systemctl daemon-reload 7. service koha-common stop 8. service koha-common start
Alternative (more secure) systemd inspired by https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container/: Systemd in container (insecurely): 0. Build an image FROM koha/koha-testing:master 1. Install systemd and systemd-sysv 2. CMD ["/sbin/init"] 3. Update your docker-compose file to use this new systemd image for koha container 4. Update your docker-compose file to have a volume "/sys/fs/cgroup:/sys/fs/cgroup:ro" for the koha container 5. Enter into the koha container and run /kohadevbox/run.sh by hand 6. systemctl daemon-reload 7. service koha-common stop 8. service koha-common start
Is this patch ready for testing, David?
(In reply to Jonathan Druart from comment #5) > Is this patch ready for testing, David? I think so. I must've forgotten to mark it as Needs Signoff.
/kohadevbox/run.sh yields the following error. Note: Writing koha-zebra.8 Running [sudo rm /usr/share/man/man8/koha-*.8.gz]... Running [sudo gzip /usr/share/man/man8/koha-*.8]... See kohadev-db-request.txt for database creation request. Please forward it to the right person, and then run /usr/sbin/koha-create --populate-db kohadev Thanks. Failed to connect to bus: No such file or directory [....] Restarting apache2 (via systemctl): apache2.serviceFailed to connect to bus: No such file or directory failed! ###### /h/d/d/k/koha-testing-docker ❯❯❯ cat Dockerfile-27844 FROM koha/koha-testing:master RUN apt-get update \ && apt-get -y install systemd systemd-sysv CMD ["/sbin/init"] ###### git diff docker-compose.yml koha: - image: koha/koha-testing:${KOHA_IMAGE} + image: container-bug-27844 depends_on: [...] - /home/datumoj/dev/koha/koha-testing-docker/persistent-files/bash_history-koha:/var/lib/koha/kohadev/.bash_history + - /sys/fs/cgroup:/sys/fs/cgroup:ro tmpfs: ##### build command docker build -t container-bug-27844 -f Dockerfile-27844 .
Bizarre. I'm probably not going to look at this again any time soon, so you might want to try a non-containerized Docker environment.
> you might want to try a non-containerized Docker environment. You mean a non-koha-testing-docker env? Still using docker and with manual Koha install. And what about a KohaDevBox?
(In reply to Victor Grousset/tuxayo from comment #9) > > you might want to try a non-containerized Docker environment. > > You mean a non-koha-testing-docker env? Still using docker and with manual > Koha install. Haha I meant a non-containerized Dev environment. I used the wrong D word. > And what about a KohaDevBox? Yep that should work.
Created attachment 120817 [details] [review] Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Lol so easy to test with a devbox :D It works! A bit out of topic: Good thing it's still there. If the question of redoing it as wrapper of koha-testing-docker come up, it needs to be kept in mind that such tests won't be as easy due to loosing systemd in the process. Likely not that often needed to be a great weight in the balance. I could have used vagrant for a Debian VM and installed Koha there. Hum, sharing the code with the host might be difficult. And maybe I would have needed this gitify thing. Hum, might be harder than expected. </offtopic>
Created attachment 120944 [details] [review] Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Pushed to master for 21.05, thanks to everybody involved!
Pushed to 20.11.x for 20.11.06
Missing dependency, not backported to 20.05.x