Error: "user" directive makes sense only if the master process runs with super-user privileges

Question

Hi I am getting the following errors as I try to implement a new user in my dockerfile rather than using the root user.

2020-10-16T09:28:04.554363522Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:04.564383012Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
2020-10-16T09:28:06.882365055Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:06.891084727Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
2020-10-16T09:28:09.331807870Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:09.342560643Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)

Below is the following dockerfile that I have created. I have created a new called api-gateway, however, when I build my docker image and run the container I get the above errors.

Any suggestions to what changes I need to implement to get the user working instead of root user?

USER root
RUN microdnf --setopt=tsflags=nodocs install -y nginx procps shadow-utils net-tools ca-certificates dirmngr gnupg wget vim\
            && microdnf clean all \
            && rpm -q procps-ng

ENV NGINX_USER="api-gatway" \
    NGINXR_UID="8987" \
    NGINX_GROUP="api-gatway" \
    NGINX_GID="8987"     

RUN set -ex; \
  groupadd -r --gid "$NGINX_GID" "$NGINX_GROUP"; \
  useradd -r --uid "$NGINXR_UID" --gid "$NGINX_GID" "$NGINX_USER" 

#To start up NGINX 
EXPOSE 80
RUN mkdir -p /var/lib/nginx/
RUN mkdir -p /var/log/nginx/

RUN mkdir -p /var/lib/nginx/tmp/

RUN chown api-gatway /var/lib/nginx/
RUN chownd api-gatway /var/log/nginx/
USER api-gatway
CMD ["nginx", "-g", "daemon off;"]

Solution

Please add the volume and volume mount section in your deployment yaml file :

volumes:

- name: nginx-dir
  emptyDir: { }
- name: nginx-empty
  emptyDir: { }
- name: nginx-run
  emptyDir: { }

volumeMounts:

- mountPath: /etc/nginx/conf.d/
  name: nginx-dir
- mountPath: /var/cache/nginx/client_temp
  name: nginx-empty
- mountPath: /var/run/
  name: nginx-run

This should allow you to access the particular dir without root user.

Comments

[David Maze]

Since you specify an alternate USER in the Dockerfile, nginx can't switch users at startup time. You can specify a user in the Dockerfile, or the nginx configuration, but it doesn't make sense to do both.

[Bilal Yousaf]

hmm, i have run the docker-image on Kubernates cluster, the user error seems to go away. But the permission denied error still remains nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)

[xbmono]

Have you fixed this issue?

[Dzienny]

It appears the nginx is already running as a user api-gatway, hence the warning. How did you check that it is not the case? What is the output of ps aux | grep nginx ?