Use the oc run command to create the docker-nginx pod.
[student@workstation ~]$ oc run docker-nginx \
--image registry.ocp4.example.com:8443/redhattraining/docker-nginx:1.23
pod/docker-nginx created
After a few moments, verify the status of the docker-nginx pod.
[student@workstation ~]$ oc get pods
NAME READY STATUS RESTARTS AGE
docker-nginx 0/1 Error 0 4s
[student@workstation ~]$ oc get pods
NAME READY STATUS RESTARTS AGE
docker-nginx 0/1 CrashLoopBackOff 2 (17s ago) 38s
The docker-nginx pod failed to start.
Investigate the pod failure. Retrieve the logs of the docker-nginx pod to identify a possible cause of the pod failure.
[student@workstation ~]$ oc logs docker-nginx
...output omitted...
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/12/02 18:51:45 [warn] 1#1: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:2
2022/12/02 18:51:45 [emerg] 1#1: mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
The pod failed to start because of permission issues for the nginx directories.
Create a debug pod for the docker-nginx pod.
[student@workstation ~]$ oc debug pod/docker-nginx
Starting pod/docker-nginx-debug ...
Pod IP: 10.8.0.72
If you don't see a command prompt, try pressing enter.
$
From the debug pod, verify the permissions of the /etc/nginx and /var/cache/nginx directories.
$ ls -la /etc/ | grep nginx
drwxr-xr-x. 3 root root 132 Nov 15 13:14 nginx
$ ls -la /var/cache | grep nginx
drwxr-xr-x. 2 root root 6 Oct 19 09:32 nginx
Only the root user has permission to the nginx directories. The pod must therefore run as the privileged root user to work.
Retrieve the user ID (UID) of the docker-nginx user to determine whether the user is a privileged or unprivileged account. Then, exit the debug pod.
$ whoami
1000820000
$ exit
Removing debug pod ...
Your UID value might differ from the previous output.
A UID over 0 means that the container's user is a non-root account. Recall that OpenShift default security policies prevent regular user accounts, such as the developer user, from running pods and their containers as privileged accounts.
Confirm that the docker-nginx:1.23 image requires the root privileged account. Use the skopeo inspect --config command to view the configuration for the image.
[student@workstation ~]$ skopeo inspect --config \
docker://registry.ocp4.example.com:8443/redhattraining/docker-nginx:1.23
...output omitted...
"config": {
"ExposedPorts": {
"80/tcp": {}
},
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NGINX_VERSION=1.23.3",
"NJS_VERSION=0.7.9",
"PKG_RELEASE=1~bullseye"
],
"Entrypoint": [
"/docker-entrypoint.sh"
],
"Cmd": [
"nginx",
"-g",
"daemon off;"
],
"Labels": {
"maintainer": "NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e"
},
"StopSignal": "SIGQUIT"
},
...output omitted...
The image configuration does not define USER metadata, which confirms that the image must run as the root privileged user.
The docker-nginx:1-23 container image must run as the root privileged user. OpenShift security policies prevent regular cluster users, such as the developer user, from running containers as the root user. Delete the docker-nginix pod.
[student@workstation ~]$ oc delete pod docker-nginx
pod "docker-nginx" deleted
