{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/docker-vault/issues/17","repository_url":"https://api.github.com/repos/hashicorp/docker-vault","labels_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/17/comments","events_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/17/events","html_url":"https://github.com/hashicorp/docker-vault/issues/17","id":196298088,"number":17,"title":"vault can no longer be started without escalated privileges","user":{"login":"ColinHebert","id":232139,"avatar_url":"https://avatars.githubusercontent.com/u/232139?v=3","gravatar_id":"","url":"https://api.github.com/users/ColinHebert","html_url":"https://github.com/ColinHebert","followers_url":"https://api.github.com/users/ColinHebert/followers","following_url":"https://api.github.com/users/ColinHebert/following{/other_user}","gists_url":"https://api.github.com/users/ColinHebert/gists{/gist_id}","starred_url":"https://api.github.com/users/ColinHebert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ColinHebert/subscriptions","organizations_url":"https://api.github.com/users/ColinHebert/orgs","repos_url":"https://api.github.com/users/ColinHebert/repos","events_url":"https://api.github.com/users/ColinHebert/events{/privacy}","received_events_url":"https://api.github.com/users/ColinHebert/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-18T20:43:08Z","updated_at":"2016-12-18T23:18:56Z","closed_at":"2016-12-18T23:18:56Z","body":"Since the addition of this snippet:\r\n\r\n```bash\r\n# Allow mlock to avoid swapping Vault memory to disk\r\nsetcap cap_ipc_lock=+ep $(readlink -f $(which vault))\r\n```\r\n\r\nVault can't be started without having to obtain privileges. Which means that the container can't be used for any operation that doesn't interact with the memory at all (using it as a client for example) without being able to do IPC_LOCK.\r\n\r\nThe good part is that the entrypoint script might offer a solution. If we can detect whether or not the `vault` executable is indeed still executable after the `setcap`, we should be able to revert the `setcap` (with a big warning saying that IPC_LOCK isn't available within the container).\r\n\r\nIf the automatic detection isn't good enough of a solution, we could have an env variable which, if set, prevents the setcap from being executed in the first place.\r\n\r\nMy preference would be for the first option as it makes it easier to people to use (instead of failing, trying to understand why the vault executable stopped working, etc.), but the second one would work as well."}}
{"actor":{"display_login":"jefferai"}}