Auto-fix volume permissions

[Al2Klimov]

https://community.icinga.com/t/icinga2-docker-on-synology/5649

[Al2Klimov]

Oh, and please test how this behaves w/ running as root being forbidden by K8s.

[bartlebi]

Any news?
Same problem on DS220+

[julianbrost]

I do not like the idea of adding custom suid binaries to the container. Writing them correctly is really hard and this just adds attack surface.

How do other Docker images handle this situation? Why can't the volume be created with the correct permissions? If we conclude that we indeed need to chown as root, this should be done by the entrypoint starting as root and then dropping permissions. This avoids the whole problem that the suid binary might have bugs that could allow to escalate privileges in the container.

[Al2Klimov]

We can't do this as some companies disallow root.

[julianbrost]

I doubt they want a random suid binary either. It should be possible to build the entrypoint so that it only does chown if it's started as root. If you don't want that, you start the container with --user icinga and everyone should be fine.

[Al2Klimov]

How do you run the container?