Running Bash Script in a Browser Even with Apache Permissions Set

Question

I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.

So, I created a bash script that runs the Docker command (runcontainer.sh):

#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject

Then I created a PHP file that runs that shell script (webscript.php):

<?php
    exec('/usr/lib/cgi-bin/runcontainer.sh');
?>

I am running ubuntu 16.04 with apache2 installed.

Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.

I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.

Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.

Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.

Answer 1

I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.

To check if you can run command without password, login as root user and then

# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh

Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.

%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh

If above works, we can focus on next level.