Roman Donchenko
7d196441bc
This is a continuation of #9743. I believe this makes the entire chart compatible with `runAsNonRoot`, as long as you disable the "permission fix" container. The actual changes for the two services are quite different: * Kvrocks already runs as a non-root user, but it specifies that user as a string, which is incompatible with `runAsNonRoot`. Override it with an explicit `runAsUser` setting. I have submitted a patch for this upstream, so this workaround will not be necessary for future versions of Kvrocks. * Vector runs as root. However, it seems that (in our configuration, at least) it can be forced to run with a non-root UID without any difficulties, so do that. A few other changes are in support of that: * I changed the port from 80 to 8282, since unprivileged users are usually unable to listen on ports < 1024. With Docker this isn't a problem, but K8s often uses different container runtimes. I chose 8282, since we already use this port in the development configuration. * I set `data_dir` to `/vector-data-dir` in the config file. By default, this setting is set to `/var/lib/vector`, which is only writeable by root. `/vector-data-dir` is mounted as a tmpfs volume into the container, therefore it has 777 permissions. TBH, I'm not sure if Vector actually writes anything to this directory in our configuration, but this gives me more peace of mind. To maintain consistency between Compose and Helm deployments, I also changed the UID/GID in the Compose file, and added a `/vector-data-dir` volume.
122 lines
3.3 KiB
YAML
122 lines
3.3 KiB
YAML
#
|
|
# Copyright (C) 2021-2022 Intel Corporation
|
|
# Copyright (C) CVAT.ai Corporation
|
|
#
|
|
# SPDX-License-Identifier: MIT
|
|
#
|
|
|
|
services:
|
|
cvat_db:
|
|
ports:
|
|
- '127.0.0.1:5432:5432'
|
|
|
|
cvat_server:
|
|
build:
|
|
context: .
|
|
args:
|
|
http_proxy:
|
|
https_proxy:
|
|
socks_proxy:
|
|
CLAM_AV:
|
|
CVAT_DEBUG_ENABLED:
|
|
COVERAGE_PROCESS_START:
|
|
environment:
|
|
# Use this with CVAT_DEBUG_ENABLED to avoid server response timeouts
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9090'
|
|
# If 'yes', wait for a debugger connection on startup
|
|
CVAT_DEBUG_WAIT: '${CVAT_DEBUG_WAIT_CLIENT:-no}'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '127.0.0.1:9090:9090'
|
|
|
|
cvat_worker_export:
|
|
environment:
|
|
# For debugging, make sure to set 1 process
|
|
# Due to the supervisord specifics, the extra processes will fail and
|
|
# after few attempts supervisord will give up restarting, leaving only 1 process
|
|
# NUMPROCS: 1
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9092'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '9092:9092'
|
|
|
|
cvat_worker_import:
|
|
environment:
|
|
# For debugging, make sure to set 1 process
|
|
# Due to the supervisord specifics, the extra processes will fail and
|
|
# after few attempts supervisord will give up restarting, leaving only 1 process
|
|
# NUMPROCS: 1
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9093'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '127.0.0.1:9093:9093'
|
|
|
|
cvat_worker_quality_reports:
|
|
environment:
|
|
# For debugging, make sure to set 1 process
|
|
# Due to the supervisord specifics, the extra processes will fail and
|
|
# after few attempts supervisord will give up restarting, leaving only 1 process
|
|
# NUMPROCS: 1
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9094'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '127.0.0.1:9094:9094'
|
|
|
|
cvat_worker_consensus:
|
|
environment:
|
|
# For debugging, make sure to set 1 process
|
|
# Due to the supervisord specifics, the extra processes will fail and
|
|
# after few attempts supervisord will give up restarting, leaving only 1 process
|
|
# NUMPROCS: 1
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9096'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '127.0.0.1:9096:9096'
|
|
|
|
cvat_worker_annotation:
|
|
environment:
|
|
# For debugging, make sure to set 1 process
|
|
# Due to the supervisord specifics, the extra processes will fail and
|
|
# after few attempts supervisord will give up restarting, leaving only 1 process
|
|
# NUMPROCS: 1
|
|
CVAT_DEBUG_ENABLED: '${CVAT_DEBUG_ENABLED:-no}'
|
|
CVAT_DEBUG_PORT: '9091'
|
|
COVERAGE_PROCESS_START:
|
|
ports:
|
|
- '127.0.0.1:9091:9091'
|
|
|
|
cvat_ui:
|
|
build:
|
|
context: .
|
|
args:
|
|
http_proxy:
|
|
https_proxy:
|
|
no_proxy:
|
|
socks_proxy:
|
|
dockerfile: Dockerfile.ui
|
|
|
|
cvat_clickhouse:
|
|
ports:
|
|
- '127.0.0.1:8123:8123'
|
|
|
|
cvat_opa:
|
|
ports:
|
|
- '127.0.0.1:8181:8181'
|
|
|
|
cvat_redis_inmem:
|
|
ports:
|
|
- '127.0.0.1:6379:6379'
|
|
|
|
cvat_redis_ondisk:
|
|
ports:
|
|
- '127.0.0.1:6666:6666'
|
|
|
|
cvat_vector:
|
|
ports:
|
|
- '127.0.0.1:8282:8282'
|