在Kubernetes中运行带Nginx的Redocly开发者门户遇权限错误

尝试在Kubernetes中部署Redocly开发者门户，用Nginx反向代理解决仅绑定localhost的问题，但运行时持续遭遇权限问题。已尝试在Dockerfile中添加RUN chmod -R 777 /var和RUN chmod -R 777 /etc/nginx（虽不规范但无其他办法），仍报错。

Dockerfile内容 #

FROM docker.abc.cc/node:16-alpine

# Define arguments and environment variables
ARG ARTIFACTORY_USERNAME
ARG ARTIFACTORY_PASSWORD
ENV ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME
ENV ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD

# Add curl and bash for debugging
RUN apk add --no-cache curl bash nginx

# Install npm-cli-login
RUN npm install -g npm-cli-login

WORKDIR /usr/src/app

# Log in to Artifactory
RUN \
    npm-cli-login \
    -u $ARTIFACTORY_USERNAME \
    -p $ARTIFACTORY_PASSWORD \
    -e $ARTIFACTORY_USERNAME@abc.com \
    -r https://artifactory.abc.cc/artifactory/api/npm/npm

# Copy package files and install dependencies
COPY --chown=node package*.json /usr/src/app/
RUN npm install --legacy-peer-deps

# Copy application files
COPY --chown=node . /usr/src/app/

# Add Nginx configuration file
COPY nginx.conf /etc/nginx/nginx.conf

RUN chmod -R 777 /usr/src
RUN chmod -R 777 /var
RUN chmod -R 777 /etc/nginx

# Start Nginx and the application
CMD ["sh", "-c", "nginx && npm start"]

# Expose the Nginx port
EXPOSE 3001

Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: caas-dev-portal
  namespace: internal-tools
spec:
  replicas: 2
  revisionHistoryLimit: 3
  template:
    spec:
      containers:
      - env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        envFrom:
        - configMapRef:
            name: caas-dev-portal
        - configMapRef:
            name: abc-k8s-cluster-info
        - secretRef:
            name: apm-settings
        image: docker.abc.cc/caas-portal:v1test
        imagePullPolicy: Always
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sleep
              - "30"
        name: web
        ports:
        - containerPort: 3001
          name: http-api
        - containerPort: 9999
          name: http-management
        resources:
          limits:
            cpu: 1500m
            ephemeral-storage: 1Gi
            memory: 1024Mi
          requests:
            cpu: 100m
            ephemeral-storage: 10Mi
            memory: 128Mi
        startupProbe:
          failureThreshold: 45
          httpGet:
            path: /health
            port: http-api
          periodSeconds: 4
      imagePullSecrets:
      - name: artifactory-docker-registry
      restartPolicy: Always
      serviceAccountName: caas-dev-portal
      terminationGracePeriodSeconds: 40

应用报错日志 #

/usr/src/app/node_modules/yoga-layout-prebuilt/yoga-layout/build/Release/nbind.js:53
        throw ex;
        ^

Error: EPERM: operation not permitted, copyfile '/usr/src/app/package.json' -> '/usr/src/app/node_modules/@redocly/developer-portal/dist/engine/package.json'
    at copyFileSync (node:fs:2847:3)
    at runCommand (/usr/src/app/node_modules/@redocly/developer-portal/dist/cli/run-command.js:1:356)
    at Object.handler (/usr/src/app/node_modules/@redocly/developer-portal/dist/cli.js:2:1376)
    at Object.runCommand (/usr/src/app/node_modules/@redocly/developer-portal/node_modules/yargs/build/index.cjs:446:48)
    at Object.parseArgs [as _parseArgs] (/usr/src/app/node_modules/@redocly/developer-portal/node_modules/yargs/build/index.cjs:2697:57)
    at Object.get [as argv] (/usr/src/app/node_modules/@redocly/developer-portal/node_modules/yargs/build/index.cjs:2651:25)
    at Object.<anonymous> (/usr/src/app/node_modules/@redocly/developer-portal/dist/cli.js:2:4118)
    at Module._compile (node:internal/modules/cjs/loader:1198:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1252:10)
    at Module.load (node:internal/modules/cjs/loader:1076:32) {
  errno: -1,
  syscall: 'copyfile',
  code: 'EPERM',
  path: '/usr/src/app/package.json',
  dest: '/usr/src/app/node_modules/@redocly/developer-portal/dist/engine/package.json'
}
npm notice
npm notice New major version of npm available! 8.19.4 -> 9.8.1
npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.8.1>
npm notice Run `npm install -g npm@9.8.1` to update!
npm notice

1. 修复Node应用的文件权限 #

报错核心是node_modules目录归root所有，而运行npm start的node用户没有写入权限。修改Dockerfile：

• 在npm install后，将node_modules目录权限转交给node用户：

  RUN npm install --legacy-peer-deps && chown -R node:node /usr/src/app/node_modules
  

• 移除RUN chmod -R 777 /usr/src，避免不安全的全局权限开放。

2. 正确配置Nginx权限 #

Nginx默认以nginx用户运行，只需给它需要的目录授权，无需全局777：

• 创建Nginx必要目录并设置权限：

  RUN mkdir -p /var/log/nginx /var/lib/nginx && chown -R nginx:nginx /var/log/nginx /var/lib/nginx /etc/nginx
  

• 替换原来的RUN chmod -R 777 /var和RUN chmod -R 777 /etc/nginx。

3. 指定容器运行用户 #

基础镜像默认的node用户UID是1000，切换到该用户运行容器，同时处理Nginx端口绑定问题：

• 如果Nginx需要绑定80/443这类特权端口，给node用户添加权限：

  RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx
  USER node
  

• 如果Nginx监听3001这类非特权端口，直接添加USER node即可。

4. Kubernetes Deployment安全上下文（可选） #

在Deployment容器配置中添加安全上下文，强制非root运行并匹配权限：

securityContext:
  runAsUser: 1000
  runAsGroup: 1000
  allowPrivilegeEscalation: false

完整修改后的Dockerfile示例 #

FROM docker.abc.cc/node:16-alpine

# Define arguments and environment variables
ARG ARTIFACTORY_USERNAME
ARG ARTIFACTORY_PASSWORD
ENV ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME
ENV ARTIFACTORY_PASSWORD=$ARTIFACTORY_PASSWORD

# Add curl and bash for debugging
RUN apk add --no-cache curl bash nginx

# Install npm-cli-login
RUN npm install -g npm-cli-login

WORKDIR /usr/src/app

# Log in to Artifactory
RUN \
    npm-cli-login \
    -u $ARTIFACTORY_USERNAME \
    -p $ARTIFACTORY_PASSWORD \
    -e $ARTIFACTORY_USERNAME@abc.com \
    -r https://artifactory.abc.cc/artifactory/api/npm/npm

# Copy package files and install dependencies
COPY --chown=node package*.json /usr/src/app/
RUN npm install --legacy-peer-deps && chown -R node:node /usr/src/app/node_modules

# Copy application files
COPY --chown=node . /usr/src/app/

# Add Nginx configuration file
COPY nginx.conf /etc/nginx/nginx.conf

# Configure Nginx permissions
RUN mkdir -p /var/log/nginx /var/lib/nginx && chown -R nginx:nginx /var/log/nginx /var/lib/nginx /etc/nginx
# 给node用户绑定特权端口的权限（如果Nginx用80/443）
RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx

# Switch to node user
USER node

# Start Nginx and the application
CMD ["sh", "-c", "nginx && npm start"]

# Expose the Nginx port
EXPOSE 3001

内容的提问来源于stack exchange，提问作者lightweight