support for OpenShift/documentaton

[1kaushik1]

Hello,
Any documentations for running this on OCP, on installing on OCP , the pod fails with the error

Error: Can't drop privilege as nonroot user
For help, use /usr/bin/supervisord -h

I believe this is because OCP is restricted and doesnt allow privileged containers, even after allowing the privilege SCC to the service account, it fails.

Thanks in advance

[cfis]

Hmm, the security context is here:

https://github.com/docker-mailserver/docker-mailserver-helm/blob/master/charts/docker-mailserver/values.yaml#L224C2-L227C1

So in theory the container should not be run with root user, but I just checked and it is. Not sure why - would have to investigate.

Anyway, not sure if docker-mailerserver itself works without root access, but it would certainly be better if it did. Happy to take a PR if you want to play around with this.

[cfis]

See #164 (comment).
Guessing this likely won't work. In addition, the security context settings don't work according to this report - #163.

[polarathene]

it would certainly be better if it did

You can run it rootless AFAIK, which keeps the container internally running as root UID 0, but on the host it's mapped to a range above 2^16, thus if escaped is not actually the root user. My rootless experience is a bit limited, I think besides the /etc/subuid assignment one container UID can be mapped to the non-root user on the host.

Running as a non-root user in the container however in both rootful/rootless containers is not going to work.