1

I have a program that sits in a Docker container. I want to be able to go to a browser page and run the Docker container so the program will start.

So, I created a bash script that runs the Docker command (runcontainer.sh):

#!/bin/sh
sudo docker run -ti --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix myproject

Then I created a PHP file that runs that shell script (webscript.php):

<?php
    exec('/usr/lib/cgi-bin/runcontainer.sh');
?>

I am running ubuntu 16.04 with apache2 installed.

Problem:
The program runs if I run php webscript.php in a bash terminal. The container starts, and the program starts. However, if I try from the web browser (firefox), it doesn't.

I go to http://localhost/cgi-bin/webscript.php, I see the page, but the Docker container never starts. So, I looked at /var/log/apache2/error.log, and saw this error: sudo: no tty present and no askpass program specified.

Based on similar questions, I ran sudo apachectl -S to see the name of apache user and group. It is www-data for both. So, I set the user and group to the /usr/lib/cgi-bin/ directory to www-data.

Even with www-data having full permissions, I still see the sudo: no tty present and no askpass program specified error. Other answers I've found say to change the sudoers file to give www-data ALL access. I didn't want to do that though because it seems unsafe.

2
  • 3
    @Jesse_b Note that allowing www-data to become root is generally a big security risk.
    – Kusalananda
    Commented Feb 23, 2019 at 19:49
  • 1
    @Jesse_b I tried it just to see if it would work. I added %www-data ALL=(ALL) NOPASSWD: /usr/bin/lib/cgi-bin to the bottom of my /etc/sudoers script and restarted the apache server with service apache2 restart, I got the same tty error. Commented Feb 23, 2019 at 19:50

1 Answer 1

1

I performed few experiments (using Cron instead of Apache and /bin/ls instead of runcontainer.sh) to reproduce error message you encountered. Based on that, I suggest you first verify whether www-data can run your intended command without password.

To check if you can run command without password, login as root user and then

# su - -s /bin/bash www-data
$ sudo /usr/lib/cgi-bin/runcontainer.sh

Also, You should also check /etc/sudoers whether you have enabled /usr/lib/cgi-bin/runcontainer.sh for www-data user.

%www-data ALL=(ALL) NOPASSWD: /usr/lib/cgi-bin/runcontainer.sh

If above works, we can focus on next level.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .