Skip to content

WIP: Run activemq container as non root #1378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
Open

WIP: Run activemq container as non root #1378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
0250c68
always use simpleAuth (temp approach)
alxgomz Jan 15, 2025
87d4489
move simpleAuth params to env vars
alxgomz Jan 15, 2025
80cf559
remove anon auth properties as anonymousAccessAllowed do not lookup p…
alxgomz Jan 15, 2025
723eb16
move SimpleAuth plugin config to multistage build
alxgomz Jan 16, 2025
cdc6bd0
toggle jmx context from env var
alxgomz Jan 16, 2025
9a3345d
set jmx auth at guild time (to avoid the need to write to container fs)
alxgomz Jan 16, 2025
e1a5b79
run as non root user
alxgomz Jan 17, 2025
ca6954d
make linter happy
alxgomz Jan 17, 2025
ee2c9b6
reintroduce runtime jmx auth config
alxgomz Jan 17, 2025
3fb641f
allow buiding image that do not write logs to container fs
alxgomz Jan 17, 2025
59db1d6
allow configuring web auth at build time and fix it for AMQ5
alxgomz Jan 17, 2025
b7f12b6
remove added JMX auth config as it simply doesn't work
alxgomz Jan 17, 2025
5b9efdd
remove useless LOG_TO_FS
alxgomz Jan 17, 2025
a8cff13
cleanup
alxgomz Jan 17, 2025
ed75e96
update doc
alxgomz Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 70 additions & 14 deletions assembly/src/docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,31 +15,87 @@
# See the License for the specific language governing permissions and
# limitations under the License.
################################################################################
FROM debian:bookworm-slim AS amq_tpl
# activemq_dist can point to a directory or a tarball on the local system
ARG activemq_dist=NOT_SET
ARG ACTIVEMQ_WEB_DEFAULT_USER=admin
ARG ACTIVEMQ_WEB_DEFAULT_PASSWORD=admin

ENV DEBIAN_FRONTEND=noninteractive

# Prepare ActiveMQ distribution
ADD $activemq_dist /

RUN mv /apache-activemq-* /apache-activemq
WORKDIR /apache-activemq
RUN apt-get update && apt-get install xmlstarlet -y
RUN xmlstarlet ed -L \
-N d='http://www.springframework.org/schema/beans' \
-N a='http://activemq.apache.org/schema/core' \
-d '//comment()' \
-s '/d:beans/a:broker' -t elem -n plugins \
-s '/d:beans/a:broker/plugins' -t elem -n simpleAuthenticationPlugin \
-s '/d:beans/a:broker/plugins/simpleAuthenticationPlugin' -t elem -n users \
-a '/d:beans/a:broker/plugins/simpleAuthenticationPlugin' -t attr -name anonymousAccessAllowed -v true \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enabling anonymous access should not be the default

Copy link
Author

@alxgomz alxgomz Feb 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. I first tried to make it point to another env var but it did not work and I concluded the plugin attribute anonymousAccessAllowed is simply not looked up from the java system properties unlike authenticationUser attribute (e.g. username or password).
Given the default behavior of the exisitng image was already to come up with anonymous access enabled (one has to provide $ACTIVEMQ_CONNECTION_USER to disable it), I've decided to let anonymous access enabled b default as well.

I personally have no problem with setting it to false b default instead, unless there's a way to make the plugin initialization lookup a java system property for anonymousAccessAllowed?

-s '/d:beans/a:broker/plugins/simpleAuthenticationPlugin/users' -t elem -n authenticationUser \
-a '/d:beans/a:broker/plugins/simpleAuthenticationPlugin/users/authenticationUser' -t attr -n username -v '${activemq.username}' \
-a '/d:beans/a:broker/plugins/simpleAuthenticationPlugin/users/authenticationUser' -t attr -name password -v '${activemq.password}' \
-a '/d:beans/a:broker/plugins/simpleAuthenticationPlugin/users/authenticationUser' -t attr -name groups -v '${activemq.groups}' \
conf/activemq.xml
RUN xmlstarlet ed -L \
-N d='http://www.springframework.org/schema/beans' \
-N a='http://activemq.apache.org/schema/core' \
-u '/d:beans/a:broker/a:managementContext/a:managementContext/@createConnector' -v '${activemq.jmx.enabled}' \
conf/activemq.xml
# Configure default web console authentication for ActiveMQ 5.x and 6.x
RUN if [ -n "$ACTIVEMQ_WEB_DEFAULT_USER" ]; then \
sed -i "s/admin=/${ACTIVEMQ_WEB_DEFAULT_USER}=/g" conf/users.properties; \
sed -i "s/=admin/=${ACTIVEMQ_WEB_DEFAULT_USER}/g" conf/groups.properties; \
fi; \
if [ -n "$ACTIVEMQ_WEB_DEFAULT_PASSWORD" ]; then \
sed -i "s/=admin/=${ACTIVEMQ_WEB_DEFAULT_PASSWORD}/g" conf/users.properties; \
fi; \
if [ -f conf/jetty-realm.properties ]; then \
sed -i "s/admin: admin/${ACTIVEMQ_WEB_DEFAULT_USER}: ${ACTIVEMQ_WEB_DEFAULT_PASSWORD}/" conf/jetty-realm.properties; \
fi
RUN rm conf/credentials.properties && touch conf/credentials.properties && \
mkdir tmp && \
chmod -R g+w conf data tmp

FROM eclipse-temurin:17-jre
ARG ACTIVEMQ_USERNAME=activemq
ARG ACTIVEMQ_GROUPNAME=activemq
ARG ACTIVEMQ_WEB_DEFAULT_USER=admin
ARG ACTIVEMQ_WEB_DEFAULT_PASSWORD=admin

# ActiveMQ environment variables
ENV ACTIVEMQ_INSTALL_PATH /opt
ENV ACTIVEMQ_HOME $ACTIVEMQ_INSTALL_PATH/apache-activemq
ENV ACTIVEMQ_CONF $ACTIVEMQ_HOME/conf
ENV ACTIVEMQ_OPTS_MEMORY -Xms64M -Xmx1G
ENV ACTIVEMQ_EXEC exec
ENV PATH $PATH:$ACTIVEMQ_HOME/bin
ENV ACTIVEMQ_INSTALL_PATH=/opt
ENV ACTIVEMQ_HOME=$ACTIVEMQ_INSTALL_PATH/apache-activemq
ENV ACTIVEMQ_CONF=$ACTIVEMQ_HOME/conf
ENV ACTIVEMQ_OPTS_MEMORY="-Xms64M -Xmx1G"
ENV ACTIVEMQ_EXEC=exec
ENV PATH=$PATH:$ACTIVEMQ_HOME/bin
ENV ACTIVEMQ_CONNECTION_USER=system
ENV ACTIVEMQ_CONNECTION_GROUPS=users
ENV ACTIVEMQ_CONNECTION_PASSWORD=manager
ENV ACTIVEMQ_JMX_ENABLED=false
ENV ACTIVEMQ_WEB_DEFAULT_USER=$ACTIVEMQ_WEB_DEFAULT_USER
ENV ACTIVEMQ_WEB_DEFAULT_PASSWORD=$ACTIVEMQ_WEB_DEFAULT_PASSWORD

# Make the Web console accesible from outside the container
ENV ACTIVEMQ_OPTS $ACTIVEMQ_OPTS_MEMORY -Djava.util.logging.config.file=logging.properties -Djava.security.auth.login.config=$ACTIVEMQ_CONF/login.config -Djetty.host=0.0.0.0
ENV ACTIVEMQ_OPTS='$ACTIVEMQ_OPTS_MEMORY -Djava.util.logging.config.file=logging.properties -Djava.security.auth.login.config=$ACTIVEMQ_CONF/login.config -Djetty.host=0.0.0.0 -Dactivemq.username=$ACTIVEMQ_CONNECTION_USER -Dactivemq.groups=$ACTIVEMQ_CONNECTION_GROUPS -Dactivemq.password=$ACTIVEMQ_CONNECTION_PASSWORD -Dactivemq.jmx.enabled=$ACTIVEMQ_JMX_ENABLED'
#WORKDIR $ACTIVEMQ_HOME

# activemq_dist can point to a directory or a tarball on the local system
ARG activemq_dist=NOT_SET
RUN groupadd --system ${ACTIVEMQ_GROUPNAME} && \
useradd -l --system -g ${ACTIVEMQ_GROUPNAME} -d ${ACTIVEMQ_HOME} -s /bin/false ${ACTIVEMQ_USERNAME}

COPY entrypoint.sh /usr/local/bin/entrypoint.sh
COPY --from=amq_tpl --chown=:${ACTIVEMQ_GROUPNAME} /apache-activemq $ACTIVEMQ_INSTALL_PATH/apache-activemq

# Install build dependencies and activemq
ADD $activemq_dist $ACTIVEMQ_INSTALL_PATH
RUN set -x && \
cp -r $ACTIVEMQ_INSTALL_PATH/apache-activemq-* $ACTIVEMQ_HOME && \
rm -r $ACTIVEMQ_INSTALL_PATH/apache-activemq-*
RUN chmod 600 ${ACTIVEMQ_HOME}/conf/jmx.password && \
chown ${ACTIVEMQ_USERNAME}:${ACTIVEMQ_GROUPNAME} ${ACTIVEMQ_HOME}/conf/jmx.password

USER ${ACTIVEMQ_USERNAME}
EXPOSE 8161 61616 5672 61613 1883 61614 1099
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["activemq", "console"]
10 changes: 7 additions & 3 deletions assembly/src/docker/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,13 @@ Edit the `docker-compose.yml` file to edit port settings.

| Environment Variable | Description |
|----------------------|-------------|
| `ACTIVEMQ_CONNECTION_USER` | Username to access transport connector on the broker (JMS, ...). If not set, no user and password are required |
| `ACTIVEMQ_CONNECTION_USER` | Username to access transport connector on the broker (JMS, ...). If not set, no user and password are required. |
| `ACTIVEMQ_CONNECTION_PASSWORD` | Password to access transport connector on the broker (JMS, ...). It should be used with `ACTIVEMQ_CONNECTION_USER`. |
| `ACTIVEMQ_CONNECTION_GROUPS` | Comma-separated list of groups to which the user belongs. |
| `ACTIVEMQ_JMX_USER` | Username to access the JMX MBean server of the broker. If set, ActiveMQ accepts remote JMX connection, else, only local connection are allowed. |
| `ACTIVEMQ_JMX_PASSWORD` | Password to access the JMX MBean server of the broker. It should be used with `ACTIVEMQ_JMX_USER`/ |
| `ACTIVEMQ_JMX_PASSWORD` | Password to access the JMX MBean server of the broker. It should be used with `ACTIVEMQ_JMX_USER`. |
| `ACTIVEMQ_JMX_ENABLED` | Toggle ActiveMQ's JMX connector (without authentication). |
| `ACTIVEMQ_WEB_DEFAULT_USER` | Default username to access the ActiveMQ WebConsole (used at build time). |
| `ACTIVEMQ_WEB_DEFAULT_PASSWORD` | Default password to access the ActiveMQ WebConsole (used at build time). |
| `ACTIVEMQ_WEB_USER` | Username to access the ActiveMQ WebConsole. |
| `ACTIVEMQ_WEB_PASSWORD` | Password to access the ActiveMQ WebConsole. |
| `ACTIVEMQ_WEB_PASSWORD` | Password to access the ActiveMQ WebConsole. |
49 changes: 10 additions & 39 deletions assembly/src/docker/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/bin/bash
#!/bin/bash -e

################################################################################
# Licensed to the Apache Software Foundation (ASF) under one
Expand All @@ -18,48 +18,12 @@
# limitations under the License.
################################################################################

# Transport/connection security
if [ -n "${ACTIVEMQ_CONNECTION_USER}" ]; then
if [ -f "${ACTIVEMQ_HOME}/conf/connection.security.enabled" ]; then
echo "ActiveMQ Connection Security enabled"
else
echo "Enabling ActiveMQ Connection Security"
sed -i "s/activemq.username=system/activemq.username=${ACTIVEMQ_CONNECTION_USER}/" ${ACTIVEMQ_HOME}/conf/credentials.properties
sed -i "s/activemq.password=manager/activemq.password=${ACTIVEMQ_CONNECTION_PASSWORD}/" ${ACTIVEMQ_HOME}/conf/credentials.properties
read -r -d '' REPLACE << END
<plugins>
<simpleAuthenticationPlugin>
<users>
<authenticationUser username="$\{activemq.username}" password="$\{activemq.password}"/>
</users>
</simpleAuthenticationPlugin>
</plugins>
</broker>
END
REPLACE=${REPLACE//$\\/$}
REPLACE=${REPLACE//\//\\\/}
REPLACE=$(echo $REPLACE | tr '\n' ' ')
sed -i "s/<\/broker>/$REPLACE/" ${ACTIVEMQ_HOME}/conf/activemq.xml
touch "${ACTIVEMQ_HOME}/conf/connection.security.enabled"
fi
fi

# JMX security
if [ -n "${ACTIVEMQ_JMX_USER}" ]; then
if [ -f "${ACTIVEMQ_HOME}/conf/jmx.security.enabled" ]; then
echo "JMX Security already enabled"
else
echo "Enabling ActiveMQ JMX security"
read -r -d '' REPLACE << END
<managementContext>
<managementContext createConnector="true" />
</managementContext>
</broker>
END
REPLACE=${REPLACE//\//\\\/}
REPLACE=${REPLACE//$\\/$}
REPLACE=$(echo $REPLACE | tr '\n' ' ')
sed -i "s/<\/broker>/$REPLACE/" ${ACTIVEMQ_HOME}/conf/activemq.xml
sed -i "s/admin/${ACTIVEMQ_JMX_USER}/" ${ACTIVEMQ_HOME}/conf/jmx.access
sed -i "s/admin/${ACTIVEMQ_JMX_USER}/" ${ACTIVEMQ_HOME}/conf/jmx.password
if [ -n "${ACTIVEMQ_JMX_PASSWORD}" ]; then
Expand All @@ -72,9 +36,16 @@ fi
# WebConsole security
if [ -n "${ACTIVEMQ_WEB_USER}" ]; then
echo "Enabling ActiveMQ WebConsole security"
sed -i s/admin=/${ACTIVEMQ_WEB_USER}=/g ${ACTIVEMQ_HOME}/conf/users.properties
sed -i s/$ACTIVEMQ_WEB_DEFAULT_USER=/${ACTIVEMQ_WEB_USER}=/g ${ACTIVEMQ_HOME}/conf/users.properties
if [ -n "${ACTIVEMQ_WEB_PASSWORD}" ]; then
sed -i s/=admin/=${ACTIVEMQ_WEB_PASSWORD}/g ${ACTIVEMQ_HOME}/conf/users.properties
sed -i s/=$ACTIVEMQ_WEB_DEFAULT_PASSWORD/=${ACTIVEMQ_WEB_PASSWORD}/g ${ACTIVEMQ_HOME}/conf/users.properties
fi
# ACTIVEMQ 5.x
if [ -f "${ACTIVEMQ_HOME}/conf/jetty-realm.properties" ]; then
sed -i "s/${ACTIVEMQ_WEB_DEFAULT_USER}: /${ACTIVEMQ_WEB_DEFAULT_USER}: /" ${ACTIVEMQ_HOME}/conf/jetty-realm.properties
if [ -n "${ACTIVEMQ_WEB_PASSWORD}" ]; then
sed -i "s/${ACTIVEMQ_WEB_DEFAULT_USER}: ${ACTIVEMQ_WEB_DEFAULT_PASSWORD}/${ACTIVEMQ_WEB_USER}: ${ACTIVEMQ_WEB_PASSWORD}/" ${ACTIVEMQ_HOME}/conf/jetty-realm.properties
fi
fi
fi

Expand Down