PHP容器中gRPC客户端仅root可用，非root用户如何运行？

环境配置 #

• Docker镜像基于Ubuntu 22.04，内置PHP 8.1、gRPC扩展等，Dockerfile配置如下：

FROM ubuntu:22.04

ARG WWWGROUP
ARG WWWUSER
ARG NODE_VERSION=10.16.3

ENV NVM_DIR=/usr/local/nvm

WORKDIR /var/www/html

ENV DEBIAN_FRONTEND noninteractive
ENV TZ=UTC

RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

RUN apt-get update \
    && apt-get install -y gnupg gosu curl ca-certificates zip unzip git supervisor sqlite3 libcap2-bin libpng-dev python2 \
    && mkdir -p ~/.gnupg \
    && chmod 600 ~/.gnupg \
    && echo "disable-ipv6" >> ~/.gnupg/dirmngr.conf \
    && echo "keyserver hkp://keyserver.ubuntu.com:80" >> ~/.gnupg/dirmngr.conf \
    && gpg --recv-key 0x14aa40ec0831756756d7f66c4f4ea0aae5267a6c \
    && gpg --export 0x14aa40ec0831756756d7f66c4f4ea0aae5267a6c > /usr/share/keyrings/ppa_ondrej_php.gpg \
    && echo "deb [signed-by=/usr/share/keyrings/ppa_ondrej_php.gpg] https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy main" > /etc/apt/sources.list.d/ppa_ondrej_php.list \
    && apt-get update \
    && apt-get install -y php8.1-cli php8.1-dev \
       php8.1-pgsql php8.1-sqlite3 php8.1-gd \
       php8.1-curl \
       php8.1-imap php8.1-mysql php8.1-mbstring \
       php8.1-xml php8.1-zip php8.1-bcmath php8.1-soap \
       php8.1-intl php8.1-readline \
       php8.1-ldap \
       php8.1-msgpack php8.1-igbinary php8.1-redis php8.1-swoole \
       php8.1-memcached php8.1-pcov php8.1-xdebug \
       php8.1-grpc php8.1-imagick php8.1-protobuf \
    && php -r "readfile('https://getcomposer.org/installer');" | php -- --install-dir=/usr/bin/ --filename=composer \
    && curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - \
    && echo "deb https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list \
    && apt-get update \
    && apt-get install -y yarn \
    && apt-get install -y mysql-client \
    && apt-get -y autoremove \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

RUN setcap "cap_net_bind_service=+ep" /usr/bin/php8.1

RUN mkdir $NVM_DIR && chmod -R ugo+rw $NVM_DIR
RUN curl https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash \
    && . $NVM_DIR/nvm.sh \
    && nvm install $NODE_VERSION \
    && nvm alias default $NODE_VERSION \
    && nvm use default

ENV NODE_PATH $NVM_DIR/versions/node/v$NODE_VERSION/lib/node_modules
ENV PATH      $NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH

RUN groupadd --force -g $WWWGROUP sail
RUN useradd -ms /bin/bash --no-user-group -g $WWWGROUP -u $WWWUSER sail

COPY start-container /usr/local/bin/start-container
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY php.ini /etc/php/8.1/cli/conf.d/99-sail.ini
RUN chmod +x /usr/local/bin/start-container

EXPOSE 8000

ENTRYPOINT ["start-container"]

• 容器启动脚本start-container：

#!/usr/bin/env bash

if [ ! -z "$WWWUSER" ]; then
    usermod -u $WWWUSER sail
fi

if [ ! -d /.composer ]; then
    mkdir /.composer
fi

chmod -R ugo+rw /.composer

if [ $# -gt 0 ];then
    exec gosu $WWWUSER "$@"
else
    /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
fi

• Google Ads API客户端代码（已指定代理）：

(new GoogleAdsClientBuilder())
        ->withOAuth2Credential($oAuth2Credential)
        ->withDeveloperToken('xxxx')
        ->withLoginCustomerId('xxxx')
        ->withProxy('http://proxy:80/')
        ->build();

• php.ini中gRPC调试配置：

grpc.grpc_verbosity=debug
grpc.grpc_trace=dns_resolver,handshaker
grpc.log_filename=/var/www/html/storage/logs/grpc.log

• 宿主机hosts添加记录：127.0.0.1 googleads.googleapis.com

错误现象 #

• root用户执行请求：可正常通过代理连接，gRPC日志正常生成
• sail用户执行请求：报错且无gRPC日志输出

development.ERROR: { "message": "failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:443: Failed to connect to remote host: Connection refused", "code": 14, "status": "UNAVAILABLE", "details": [] }

已确认信息 #

两种用户身份下http_proxy环境变量均已正确设置

解决方案 #

1. 修复gRPC日志路径的写入权限 #

非root用户无法写入指定的日志目录，会导致gRPC扩展初始化异常，跳过代理配置：

# 在Dockerfile中添加权限配置，确保sail用户拥有日志目录所有权
RUN chown -R $WWWUSER:$WWWGROUP /var/www/html/storage/logs

或容器启动后临时执行：

docker exec -it php chown -R sail:sail /var/www/html/storage/logs

2. 删除宿主机hosts的本地映射记录 #

127.0.0.1 googleads.googleapis.com的映射会强制gRPC客户端直接连接本地443端口，完全绕过代理配置。删除该记录后，gRPC会通过指定的代理解析目标域名。

3. 修正代理参数格式 #

检查withProxy的参数格式，移除末尾多余的斜杠，确保符合gRPC要求：

->withProxy('http://proxy:80')

4. 确保切换用户时环境变量完整继承 #

修改start-container脚本，显式传递代理相关环境变量，避免gosu切换用户时丢失：

# 替换原exec命令
exec gosu $WWWUSER env PATH="$PATH" http_proxy="$http_proxy" https_proxy="$https_proxy" "$@"

5. 检查代理服务器的用户限制 #

部分代理服务器会基于请求发起的UID或用户做访问限制，确认代理允许容器内sail用户的请求流量通过。

内容的提问来源于stack exchange，提问作者user2420249