I have a webservice using docker to run nginx and haproxy (among other containers). I want to provide these docker images via a private docker hub registry, and thus don't want to build any tls certificate into the images so that each customer can mount his own certificate into the container (nginx and haproxy).
To secure the haproxy container I run it without root privileges (port above 1000 mapped to port below 1000 in docker-compose). The nginx container is based on the official nginx image and thus is only using root when the service starts and changes to the nginx user afterwards.
To further secure the containers I have setup docker-remapping (default setup with the default dockremap user).
The tls certificate public and private key are beeing mounted in the containers as the user "nobody" and thus the haproxy and nginx containers can not read these files because they use different (non-root) users to read the files.
I can make the tls files world readable e.g. 644, this works but it's a terrible unsafe solution.
I could build my own nginx image just like I did with the haproxy image and add the container users to the nobody group so that I can change the certificates permissions to 640. This is a ugly hack.
Drop docker remapping so that I can mount certificate files with the same uid as the user in the nginx and haproxy containers. This would mean I loose the security of docker-remapping and the certificate files need the same uid as the user within the haproxy and nginx containers.
Build new images during installation (and when updating the base images or the certificate files) on my customer's server with my existing images from my private docker repository as base images. The docker build files on my customers server will be very simple and are only meant to copy the ssl certificate files into the contsiners with the correct permissions.
Is there a way to map the host uid to the uid of the user within the container, so that mounted files have the correct uid?