Overriding the default Linux user

ENTERPRISE

Overriding the default Linux user

The default Linux user of a service or job can vary according to the security mode and the container type. See Linux users for more information.

The procedure for overriding the default Linux user varies by the type of service or job.

Overriding the default Linux user of a Catalog service

Many Catalog services ignore overrides of their user accounts except in strict mode. We provide detailed steps for overriding the default Linux user for services that support this in Service Accounts. Refer to the section pertaining to the service of interest for step-by-step instructions. The procedures also describe how to configure the service to use encryption and service accounts.

Remember to grant permission to perform the create action on the dcos:mesos:master:task:user[:<linux-user-name>] resource to the service account user that the Catalog service is launched with. See Mesos Permissions for more information.

Overriding the default Linux user via Marathon app definition

Marathon app definitions provide a "user" key which you can use to override the default Linux user. Tip: Reference the Marathon documentation for more details on writing Marathon services.

The following tutorial will demonstrate how ownership works in action. Before you begin, make sure that:

  • The Linux user account already exists on the agent.
  • You have installed and are logged into the DC/OS CLI.
  • You must follow the steps in Downloading the Root Cert before issuing the curl commands in this section.
  • You have granted permission to perform the create action on the dcos:mesos:master:task:user:<linux-user-name> resource to the dcos_marathon DC/OS service account user.

Once you have met these prerequisites, complete the following steps to override the default Linux user.

  1. Create a Marathon app definition and save it with an informative name such as myservice.json. The following service will write the name of the user it’s running under to the logs, create a new file, and fetch the Mesosphere logo from dcos.io.

    1. {
    2.   "id": "linux-user-override",
    3.   "cmd": "whoami && tee file && sleep 1000",
    4.   "user": "<your-test-user-account>",
    5.   "uris": [
    6.       "/mesosphere/dcos/2.1/img/logos/mesosphere.svg"
    7.   ]
    8. }

    IMPORTANT: Do not forget to replace “your-test-user-account” with the name of a Linux user who exists on the agent and differs from the default.

  2. Deploy the service using the Marathon API.

    1. curl -X POST --cacert dcos-ca.crt $(dcos config show core.dcos_url)/service/marathon/v2/apps -d @myservice.json -H "Content-type: application/json" -H "Authorization: token=$(dcos config show core.dcos_acs_token)"

  1. Check the Services tab of the DC/OS web interface to confirm that your app has been created successfully.

  2. Click your service and then click the Configuration tab.

  3. Scroll down to see the Linux user account that you specified as the value of User.

  4. Click the Tasks tab. By this time, your service should have succeeded in deploying. Click the task name.

  5. Click the Files tab.

  6. Observe the Linux user name that you passed in as the OWNER of the fetched and created files.

  7. Click to open the stdout file.

  8. Scroll to the bottom and you should see the results of the whoami command, for example, the name of the user your task is running under.

Overriding the default Linux user via Metronome job definition

Metronome job definitions provide a "user" key which you can use to override the default Linux user.

NOTE: Refer to the Jobs documentation for more information about creating and deploying jobs.

The following procedure will walk you through a quick tutorial to demonstrate how the ownership works in action. Before you begin, make sure that:

  • The Linux user account already exists on the agent.
  • You have installed and are logged into the DC/OS CLI.
  • You must follow the steps in Downloading the Root Cert before issuing the curl commands in this section.
  • You have granted permission to perform the create action on the dcos:mesos:master:task:user:<linux-user-name> resource to the dcos_metronome DC/OS service account user.

Once you have met these prerequisites, complete the following steps to override the default Linux user.

  1. Create a Metronome job definition and save it with an informative name such as myjob.json.

    1. {
    2. "id": "test-user-override",
    3. "run": {
    4.   "artifacts": [
    5.     {
    6.       "uri": "/mesosphere/dcos/2.1/img/logos/mesosphere.svg"
    7.     }
    8.   ],
    9.   "cmd": "whoami && printf 'iamme' | tee file && sleep 1000",
    10.   "cpus": 0.01,
    11.   "mem": 32,
    12.   "disk": 0,
    13.   "user": "<your-test-user-account>"
    14. }
    15. }

    IMPORTANT: Do not forget to replace “your-test-user-account” with the name of a Linux user that exists on the agent and differs from the default. The Linux user nobody will exist if you have not already provisioned a user.

  2. Deploy the job using the Metronome REST API.

    1. curl -X POST --cacert dcos-ca.crt $(dcos config show core.dcos_url)/service/metronome/v1/jobs -d @myjob.json -H "Content-type: application/json" -H "Authorization: token=$(dcos config show core.dcos_acs_token)"

  3. Check the Jobs tab of the DC/OS web interface to confirm that your job has successfully deployed.

  4. Click your job and then click Run Now.

  5. Open the drop-down menu from the top right by clicking the three stacked dots and select Run Now.

  6. Expand the job and click to open its task.

  7. Click to open the Files tab. Observe that all of the files have your Linux user as the OWNER.

  8. Click to open the stdout file.

  9. Scroll to the bottom and you should see the results of the whoami command, the name of the user your task is running under, followed by iamme.