Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Run activemq container as non root #1378

Open
wants to merge 15 commits into
base: main
Choose a base branch
from

Conversation

alxgomz
Copy link

@alxgomz alxgomz commented Jan 17, 2025

This PR is a proposal to address https://issues.apache.org/jira/browse/AMQ-9588

It's trying to keep the same behavior of the container and essentially:

  • Leverage properties lookup where possible so configuration can be done using env vars rather than sed (unfortunatelly properties lookup do not work for the anonymousAccessAllowed param of simpleAuthenticationPluginso I left it on by default to mimic to previous behavior)
  • Allow building images with non default credentials
  • Switch build process to multistage build to allow more robust installation/configuration of the activemq distrib
  • Fix web console auth for ActiveMQ 5.x
  • Create a non privileged user to run to service
  • Update doc

@mattrpav
Copy link
Contributor

  1. Leaving JMX enabled, but optionally exposing the port is a simple approach to remove a lot of scaffolding.

  2. Why is JAAS not the default just like the dist?

@mattrpav mattrpav self-requested a review January 17, 2025 19:16
@alxgomz
Copy link
Author

alxgomz commented Jan 20, 2025

Hi @mattrpav thanks for taking the time to review.

  1. Toggling JMX on and off is actually the very lightweight part of this PR. To be honest I have introduced it because I wanted to keep a similar behaviour to what pre-existed. But I would personally remove it completely given, a) JMX is such a pain in most docker environments and really not well suited to NAT networks in general and b) the authentication as it is set right now simply doesn't work: even if user and password are set one can still login anonymously as soon as the createConnector param is set t io true (btw, the doc seems to mention the jmx authenticated access should be set up using java OPTS and with the ManagementContext turned off but I could not get it to work). And c) I remember reading theere's a jolokia endpoint available somewhere that would deliver just the same data in a more friendly fashion. But I decided I would not make this kind more disruptive approach.

  2. The reason I did not used JaaS to configure web user s because I'm working with ActiveMQ 5.18 which do not seem to have the appropriate classes available and throws this error when trying to do use it:

ERROR | Failed to load: class path resource [activemq.xml], reason: Failed to load type: org.eclipse.jetty.jaas.JAASLoginService. Reason: java.lang.Cl
assNotFoundException: org.eclipse.jetty.jaas.JAASLoginService; nested exception is java.lang.ClassNotFoundException: org.eclipse.jetty.jaas.JAASLoginS
ervice                                                                                                                                                
org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load type: org.eclipse.jetty.jaas.JAASLoginService. Reason: java.lang.ClassN
otFoundException: org.eclipse.jetty.jaas.JAASLoginService; nested exception is java.lang.ClassNotFoundException: org.eclipse.jetty.jaas.JAASLoginServi
ce

Taking a look at the 5.x distribution I saw the default user was using jetty-realm properties file which was only available in 5.x dists so I chose to rely on the presence of this file to decide wether I would set the default web user

@mattrpav mattrpav changed the title Run activemq container as non root WIP: Run activemq container as non root Jan 21, 2025
@alxgomz
Copy link
Author

alxgomz commented Jan 22, 2025

@mattrpav as you renamed this PR title I was wondering whether you were expecting more work from me or are yo planning to take over from here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants