Running apache2 as www-data

[deekthesqueak]

Changes Apache ports to be outside of restrictive port range to allow apache-foreground to be run as www-data and not root.

[yosifkit]

As this could break current users' deployments I would be hesitant to change. The current configuration is the same as most default Linux installs; it is the accepted way for Apache/httpd to drop permissions itself. The process running as root does not handle requests, so a remote user cannot use it to gain root access. There is further discussion on askubuntu.com.

In docker 1.10, you can use the user namespaces to change which user "container root" maps to.

[tianon]

I think this one is already about as decent as we can be without breaking backwards compatibility -- with some minor configuration changes, -u www-data should work as-is (since Apache will just warn if it can't change to the user requested in the configuration, at most):

FROM php:7-apache
RUN sed -i 's/80/8080/g' /etc/apache2/sites-available/000-default.conf /etc/apache2/ports.conf
USER www-data

$ docker build .Sending build context to Docker daemon 2.048 kBStep 1/3 : FROM php:7-apache ---> bc943f239a7fStep 2/3 : RUN sed -i 's/80/8080/g' /etc/apache2/sites-available/000-default.conf /etc/apache2/ports.conf ---> Running in 84c37c1db043 ---> 94d6861d578aRemoving intermediate container 84c37c1db043Step 3/3 : USER www-data ---> Running in 2ce018e8363d ---> 87926a4f33dcRemoving intermediate container 2ce018e8363dSuccessfully built 87926a4f33dc
$ docker run -it --rm 87926a4f33dcAH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.18.0.17. Set the 'ServerName' directive globally to suppress this messageAH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.18.0.17. Set the 'ServerName' directive globally to suppress this message[Wed Apr 05 19:33:14.218299 2017] [mpm_prefork:notice] [pid 1] AH00163: Apache/2.4.10 (Debian) PHP/7.1.0 configured -- resuming normal operations[Wed Apr 05 19:33:14.218348 2017] [core:notice] [pid 1] AH00094: Command line: 'apache2 -D FOREGROUND'

Thanks for the contribution and discussion! ❤️