Docker-jitsi-meet: running JVB as root

[roeycohen]

Hi,

i'd like to run JVB on port 80 (<= 1024), for that i need to JVB to run as root.
Any ideas on where to start?

also, will let's encrypt work if HTTP_PORT is set to a port different than 80?

10x!

[roeycohen]

it's you should change jvb to root in this line, can someone on confirm?
https://github.com/jitsi/docker-jitsi-meet/blob/e1bd2447ae4f5e90e0acea9bf95e23b1960f70e9/jvb/rootfs/etc/services.d/jvb/run#L15

[sapkra]

You should NEVER run containers as root for security reasons.

[saghul]

I think enabling some of the capabilities (CAP_NET_ADMIN maybe?) you can bind low ports as a user.

As for LetsEncrypt, no, it only works on port 80/443.

[roeycohen]

10q guys for replying! :)

@sapkra - why not? it's the only service in it's container, and other services in the jitsi stack are running as root (e.g. nginx).

@saghul - i'll take a look on it. do you have experience with using port 80 instead 10,000? do you think it will work?

[sapkra]

@roeycohen There are a lot of articles about it in the web. Here is the first one I've found.

https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b

Yeah I think all containers are running as root right now but in my environment I can not start containers with root because this is restricted. To get them running I forked the repository and fixed the permissions so that the containers are working without root.
It's still on my list to cleanup my changes and create an PR to follow the recommended security standard in the official images.

[roeycohen]

@sapkra 10x!

running jbv on lower ports seems to fail...

JVB 2019-05-19 08:51:03.384 WARNING: [2163] org.jitsi.videobridge.EndpointMessageTransport.log() SCTP connection with drdsdocx not ready yet.
JVB 2019-05-19 08:51:03.385 WARNING: [2163] org.jitsi.videobridge.EndpointMessageTransport.log() No available transport channel, can't send a messag

guess it wasn't meant to be 😪

[saghul]

It's still on my list to cleanup my changes and create an PR to follow the recommended security standard in the official images.

❤️

[saghul]

running jbv on lower ports seems to fail...

Have you modified the container to run privileged or passed in the cap I mentioned?

[roeycohen]

Have you modified the container to run privileged or passed in the cap I mentioned?

no, just ran the jvb as root(i guess it should be enough for testing...)
exec s6-setuidgid jvb -> exec s6-setuidgid root

[roeycohen]

made some more tests, indeed, if port <= 1023 - no data is sent to jitsi.

[saghul]

I’m not sure that’s enough.

[roeycohen]

@saghul are you referring to CAP_NET_ADMIN? because the JVB process isn't running as a service but by calling /init command (at least for this dockers project)

[saghul]

yes, that's the one. Hum, good point, /init calls it... I wonder how to solve this. The webserver does bind to 80 and 443 so I guess it should just work 🤷‍♂

[roeycohen]

i believe it does, because i get different error messages...

[saghul]

Can you paste a full error log? Those lines above in this thread don't seem related, I think.

[roeycohen]

Hi Saghul,
attaching you two logs, one with 10,000 port which is working and the other is 80 which isn't.
80_notworking.log
10000_working.log

appreciate your time :)

[saghul]

I don't see any failures in the log. Is port 80 UDP open in the firewall?

[roeycohen]

don't think there's a firewall involved...
the dockers runs on VirtualBox installed on my machine, and also i also added an outbound rule in windows firewall to allow UDP 80 just in case.
maybe you can learn something from the chrome log?
jitsi.blossom.office-1558531392019.log