How to send a password to `sudo` from a Dockerfile

问题:

I am creating a docker file for local development needs. The file creates a user account with user as the password. The line that I think should work is:

# allow writes to the home directory
RUN echo "user" | sudo -S chmod 777 ~

However when I run the image interactively it seems that it failed & I see this message:

mkdir: cannot create directory ‘/home/.meteor-install-tmp’: Permission 
denied

When I run sudo -S chmod 777 ~ from within the container it works.

Here is the full script:

# docker build -t timebandit/meteor-1-5 --rm .
# docker run -v /host/path:/home/code -it timebandit/meteor-1-5 bash

FROM ubuntu:xenial

# update the system
RUN apt-get update && apt-get -y install curl \
sudo \
apt-utils \
locales \
nano

# Set the locale
RUN sudo sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' 
/etc/locale.gen && \
locale-gen
ENV LANG en_US.UTF-8  
ENV LANGUAGE en_US:en  
ENV LC_ALL en_US.UTF-8 

# set the root password
RUN echo "root:root" | chpasswd


# create a user
RUN useradd -ms /bin/bash user
RUN adduser user sudo
RUN echo 'user:user' | chpasswd

ENV HOME=/home
WORKDIR $HOME/user

USER user
# allow writes to the home directory
ARG user_pass
RUN echo $user_pass | sudo --stdin chmod 777 /home

# install meteor
RUN echo $user_pass | sudo curl https://install.meteor.com/ | sh

回答1:

I'd recommend skipping the sudo completely since you can change users with your Dockerfile:

....
# allow writes to the home directory
USER root
RUN chmod 777 /home
USER user
....

Adding sudo to your image means it's there for an attacker to use. You can change the user of a docker run or docker exec command with the -u root option any time you need to get back into the container as root.

回答2:

~ is the user's home directory, not the /home directory itself.

So do the same for /home:

RUN echo "user" | sudo -S chmod 777 /home

Let me tell you that you have two things that are usually discouraged (password in Dockerfile and 777 perms).

And as @meatspace suggests you may use docker build args:

ARG user_pass
RUN echo $user_pass | sudo -S chmod 777 /home

And build with this:

docker build --build-arg user_pass=user (and the rest of the command)