run tomcat daemon with user other that root

Question

im try create a container docker secure with alpine (rootfs) which allows me run web aplications java contained into tomcat8. In particular, what user should run the tomcat daemon as?

i'm reading the docs to apache tomcat 8 refered to this and i have a confusion. from the tomcat 8 documentation:

Tomcat should not be run under the root user. Create a dedicated user for the Tomcat process and provide that user with the minimum necessary permissions for the operating system. For example, it should not be possible to log on remotely using the Tomcat user.

but then says this:

Taking the Tomcat instances at the ASF as an example (where auto-deployment is disabled and web applications are deployed as exploded directories), the standard configuration is to have all Tomcat files owned by root with group Tomcat and whilst owner has read/write privileges, group only has read and world has no permissions. The exceptions are the logs, temp and work directory that are owned by the Tomcat user rather than root. This means that even if an attacker compromises the Tomcat process, they can't change the Tomcat configuration, deploy new web applications or modify existing web applications. The Tomcat process runs with a umask of 007 to maintain these permissions.

So, it's not clear to me which user tomcat should be run as. If the owner of CATALINA_HOME/bin/startup.sh is the root user with group tomcat and I create another user (eg app, with group tomcat) to run the tomcat daemon, after running CATALINA_HOME/bin/startup.sh will not starting because the owner user is root and the group only has read permissions.

Does anyone have experience running a tomcat daemon as a non-root user with a tar.gz binary?

Thanks in advance.

Answer 1

Create a user account tomcat. Make sure it is a member of the group tomcat.

Everywhere in the documentation where it says group permissions of "read", make them the same as the owner except without write permission. So if the user has read, write, and execute permission for a script then the group should have read and execute permission.

The aim of the security recommendation in the document is to allow the tomcat user to run the Tomcat application but not to be able to change any of the files.