Reference to configuration properties - uid in docker container

post by trstn on Dec 3, 2021

Hi,

is there a complete reference for all nexus OSS configuration properties?

How can I change the uid nexus OSS is running as in a container? (like not 200?)

thank you

best regards

Torsten

post by mmartz on Dec 7, 2021

You can find the code that generates the nexus3 docker image at GitHub - sonatype/docker-nexus3: Dockerized version of Nexus Repo Manager 3. I’m not sure how the uid gets set actually, but it’s not part of the Nexus Repository itself, but rather a part of how the docker image gets generated. This article seems relevant to your question but I’m not super-familiar with how all this works Understanding how uid and gid work in Docker containers | by Marc Campbell | Medium.

post by trstn on Dec 10, 2021

Thank you your reply, I had a look into it.

I cloned the master branch of

Here the User used (nexus with uid 200) is not set up by docker and its configs.

The uid of the nexus user is set in the chef-solo cookbook which used to install nexus OSS while building the container.

The chef-solo command used in the Dockerfile of the build fetches a cookbook tarball from github configured as follows:

ARG NEXUS_REPOSITORY_MANAGER_COOKBOOK_VERSION=“release-0.5.20210628-162332.70a6cb6”
ARG NEXUS_REPOSITORY_MANAGER_COOKBOOK_URL=“https://github.com/sonatype/chef-nexus-repository-manager/releases/download/${NEXUS_REPOSITORY_MANAGER_COOKBOOK_VERSION}/chef-nexus-repository-manager.tar.gz”

Unpacking this tarball I find a file:

[…]/cookbooks/nexus_repository_manager/recipes/users.rb

In which the UID 200 is hardcoded…

user ‘nexus’ do
    uid ‘200’
end

One may now think let’s just change it an feed a custom cookbooks tarball to the chef-solo command in the Dockerfile.

I unpack the /chef-nexus-repository-manager.tar.gz which unpacks to a folder ‘cookbooks’. I change the uid in the mentioned file to my liking.

pack it again
tar czvf cookbooks.tar.gz cookbooks
Add to Container
ADD ./cookbooks.tar.gz /cookbooks.tar.gz
run chef-solo

this fails with

/opt/chef/embedded/lib/ruby/2.5.0/fileutils.rb:1293:in `copy_stream': Is a directory - read (Errno::EISDIR)  

Well. If somebody is familiar with chef-solo and its whereabouts and has an idea how to solve this, I’d be very thankful for any hints.

post by jenglema on Jul 18, 2024

Registered just to help here…even if it is 3 years old. I hate when anyone creates a docker with hard coded uid and gid. The typical pattern I utilize to “fix” this is to build a modified container w/ compose. It’s modestly annoying because you have to figure out what files in the container need to be chowned but once you know that, it’s easy enough.

docker-compose.yml
version: "3.9"
services:
  nexus:
    image: "custom-nexus3:latest"
    build:
      dockerfile: "nexus3.Dockerfile"
    container_name: nexus
    ports:
      - 8081:8081
    restart: always
    volumes:
      - "/opt/data/nexus/:/nexus-data"
volumes:
    nexus-vol:

nexus3.Dockerfile
FROM sonatype/nexus3:latest

USER root
ENV NEXUS_UID 1008
ENV NEXUS_GID 1008

RUN sed -i -re "s/^(nexus:[^:]):[0-9]*:/\1:$NEXUS_GID:/g" /etc/group
RUN sed -i -re "s/^(nexus:[^:]):[0-9]*:[0-9]*:/\1:$NEXUS_UID:$NEXUS_GID:/g" /etc/passwd

RUN chown -R nexus:nexus /opt/sonatype/sonatype-work

USER nexus

Then just “docker compose build” and “docker compose up -d”

post by trstn on Jul 22, 2024

Thank you very much, good ole sed to the rescue! I saved this for later use. In the moment I have a block device with uid 200 mounted.

post by jenglema on Jul 22, 2024

Yea, I use sed because usermod and groupmod aren’t always available. Additionally, you could use find for the chown so you don’t need to know what files to chown ahead of time but then you have to figure out what the original id’s are first. This is untested but should do the thing.

FROM sonatype/nexus3:latest

USER root
ENV NEXUS_UID 1008
ENV NEXUS_GID 1008

RUN echo "export OLD_NEXUS_UID=`id -u nexus`" >> /envfile
RUN echo "export OLD_NEXUS_GID=`id -g nexus`" >> /envfile

RUN sed -i -re "s/^(nexus:[^:]):[0-9]*:/\1:$NEXUS_GID:/g" /etc/group
RUN sed -i -re "s/^(nexus:[^:]):[0-9]*:[0-9]*:/\1:$NEXUS_UID:$NEXUS_GID:/g" /etc/passwd

RUN . /envfile; find / -user $OLD_NEXUS_UID  -exec chown -h nexus {} \;
RUN . /envfile; find / -group $OLD_NEXUS_GID  -exec chgrp -h nexus {} \;

USER nexus