Extra groups with docker

[wz2b]

I use multi-group membership to grant access to SSL certificates and keys so I don't have to have multiple copies of these files floating throughout the system. In mosquitto, I use the user configuration option to make this work. My password file includes

mosquitto:x:115:120::/var/lib/mosquitto:/usr/sbin/nologin

the primary group being 120 which is here:

mosquitto:x:120:mosquitto
ssl-cert:x:122:influxdb,mosquitto,postgres

Note that there is a second group named ssl-cert and mosquitto (and some other stuff) has access to that. The reason for that is to grant them access to the private key to unlock the certificate.

This works great, I think because of this code:

mosquitto/src/mosquitto.c

Line 114 in 15292b2

if(initgroups(config->user, pwd->pw_gid) == -1){

This breaks when I run mosquitto from docker and I'm not quite sure why. When I run mosquitto I make sure the container has the same password and group file by mapping them to the host:

docker run \                                                                                                                                                                                                                                     
        -d \                                                                                                                                                                                                                                     
        --name mosquitto \                                                                                                                                                                                                                       
        --restart unless-stopped \                                                                                                                                                                                                               
        --user $(id -u mosquitto):122 \
        --volume /etc/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf \
        --volume /etc/mosquitto:/etc/mosquitto \
        --volume /etc/passwd:/etc/passwd,ro \
        --volume /etc/group:/etc/group,ro \
        --volume /etc/ssl:/etc/ssl,ro \
        --volume /var/log/mosquitto:/var/log/mosquitto \
        --publish target=8883,published=8883 \
        eclipse-mosquitto

When the server runs, the primary group is correct. An easy way to confirm that is to delete the log file and let it recreate it. It does so, with the correct user and group id. But mosquitto running inside the container gets permission denied trying to access /etc/ssl/private/whatever.key even though that directory and that file have g+x and g+r permission respectively.

Maybe this is more of a docker question than a mosquitto question but this technique I have outlined seems to work fine for influxdb, grafana, and postgres - but not mosquitto. Does anybody have any thoughts as to why?