Re: rootless chronyd
Remush <[email protected]> Tue, 29 Jul 2025 17:27:51 +0300
| Newsgroups | gmane.comp.time.chrony.user |
|---|---|
| Message-ID | <CAMEWNSEVGuqzEfKZr1Cfn0RdEOe8p6UbfFQBafU_X9heqXfP8A@mail.gmail.com> |
--0000000000003bd8e8063b1237a0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I also wanted to ask, It specifies that the port that is used is unprivileged, meaning not 123? But I merely am the client, and the NTP is listening on port 123. =E2=80=AB=D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92=D7= =B3, 29 =D7=91=D7=99=D7=95=D7=9C=D7=99 2025 =D7=91-17:00 =D7=9E=D7=90=D7=AA= =E2=80=AARemush=E2=80=AC=E2=80=8F <[email protected] =E2=80=AC=E2=80=8F>:=E2=80=AC > The only thing I need is the `chronyc sources` command. > > `The check for root can be disabled by the -U option` > I know wanting to do it as a container has nothing to do with this > mailetter, but can you elaborate about what you mean? > > > =E2=80=AB=D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92= =D7=B3, 29 =D7=91=D7=99=D7=95=D7=9C=D7=99 2025 =D7=91-16:11 =D7=9E=D7=90=D7= =AA =E2=80=AAMiroslav Lichvar=E2=80=AC=E2=80=8F <=E2=80=AA > [email protected]=E2=80=AC=E2=80=8F>:=E2=80=AC > >> On Tue, Jul 29, 2025 at 04:02:15PM +0300, Remush wrote: >> > I attempted to create a Docker Image with the Chronyd installed, yet t= he >> > container is rootless, meaning my uid is not root, however my gid is 0 >> > (root). >> > >> > Now it seems that running the container I receive many permission >> denied on >> > /run/chrony and more, >> > >> > My question is, Is there any way to make the service run not with root= ? >> >> Yes, chronyd can be started without root in some configurations where >> it doesn't need to access any RTC, PPS, PHC devices, but it may need >> some capabilities like CAP_SYS_TIME and CAP_NET_BIND_SERVICE (if it >> should run as a server). >> >> The check for root can be disabled by the -U option. The /run/chrony >> directory needs to exist before starting chronyd (only root can >> normally write in /run). >> >> There is an example systemd service that starts chronyd without root: >> >> https://gitlab.com/chrony/chrony/-/blob/master/examples/chronyd-restrict= ed.service >> >> -- >> Miroslav Lichvar >> >> >> -- >> To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org >> with "unsubscribe" in the subject. >> For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org >> with "help" in the subject. >> Trouble? Email [email protected] >> >> --0000000000003bd8e8063b1237a0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"rtl"><div dir=3D"ltr">I also wanted to ask,<br></div><div dir= =3D"ltr">It specifies that the port that is used is unprivileged, meaning n= ot 123?<br></div><div dir=3D"ltr">But I merely am the client, and the NTP i= s listening on port 123.</div></div><br><div class=3D"gmail_quote gmail_quo= te_container"><div dir=3D"rtl" class=3D"gmail_attr">=E2=80=AB=D7=91=D7=AA= =D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92=D7=B3, 29 =D7=91=D7=99= =D7=95=D7=9C=D7=99 2025 =D7=91-17:00 =D7=9E=D7=90=D7=AA =E2=80=AARemush=E2= =80=AC=E2=80=8F <=E2=80=AA<a href=3D"mailto:[email protected]">m.rem= [email protected]</a>=E2=80=AC=E2=80=8F>:=E2=80=AC<br></div><blockquote c= lass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px soli= d rgb(204,204,204);padding-left:1ex"><div dir=3D"rtl"><div dir=3D"ltr">The = only thing I need is the `chronyc sources` command.<br><br>`The check for r= oot can be disabled by the -U option`<br></div><div dir=3D"ltr">I know want= ing to do it as a container has nothing to do with this mailetter, but can = you elaborate about what you mean?<br><br></div></div><br><div class=3D"gma= il_quote"><div dir=3D"rtl" class=3D"gmail_attr">=E2=80=AB=D7=91=D7=AA=D7=90= =D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92=D7=B3, 29 =D7=91=D7=99=D7=95= =D7=9C=D7=99 2025 =D7=91-16:11 =D7=9E=D7=90=D7=AA =E2=80=AAMiroslav Lichvar= =E2=80=AC=E2=80=8F <=E2=80=AA<a href=3D"mailto:[email protected]" targ= et=3D"_blank">[email protected]</a>=E2=80=AC=E2=80=8F>:=E2=80=AC<br></= div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor= der-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, Jul 29, 2025 = at 04:02:15PM +0300, Remush wrote:<br> > I attempted to create a Docker Image with the Chronyd installed, yet t= he<br> > container is rootless, meaning my uid is not root, however my gid is 0= <br> > (root).<br> > <br> > Now it seems that running the container I receive many permission deni= ed on<br> > /run/chrony and more,<br> > <br> > My question is, Is there any way to make the service run not with root= ?<br> <br> Yes, chronyd can be started without root in some configurations where<br> it doesn't need to access any RTC, PPS, PHC devices, but it may need<br= > some capabilities like CAP_SYS_TIME and CAP_NET_BIND_SERVICE (if it<br> should run as a server).<br> <br> The check for root can be disabled by the -U option. The /run/chrony<br> directory needs to exist before starting chronyd (only root can<br> normally write in /run).<br> <br> There is an example systemd service that starts chronyd without root:<br> <a href=3D"https://gitlab.com/chrony/chrony/-/blob/master/examples/chronyd-= restricted.service" rel=3D"noreferrer" target=3D"_blank">https://gitlab.com= /chrony/chrony/-/blob/master/examples/chronyd-restricted.service</a><br> <br> -- <br> Miroslav Lichvar<br> <br> <br> -- <br> To unsubscribe email <a href=3D"mailto:[email protected]= y.org" target=3D"_blank">chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org</a> <br> with "unsubscribe" in the subject.<br> For help email <a href=3D"mailto:chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org"= target=3D"_blank">chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org</a> <br> with "help" in the subject.<br> Trouble?=C2=A0 Email <a href=3D"mailto:[email protected]" tar= get=3D"_blank">[email protected]</a>.<br> <br> </blockquote></div> </blockquote></div> --0000000000003bd8e8063b1237a0-- -- To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org with "unsubscribe" in the subject. For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org with "help" in the subject. Trouble? Email [email protected]