How to set up SSH for a linux container in App service, while using a non-root user in Docker?

Question

I have a single container Docker application that runs on a Linux machine in Azure app services, I have previously set up it to work with supervisord for orchestrating the different parts of my web-app, which work fine.

However, I'm running into problems when trying to set it up using a non-root user in Docker. I've followed this tutorial from Microsoft, but it only covers the case of using the root-user in Docker, which as a general security practise is not recommended.

https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?pivots=container-linux#enable-ssh

I hope you can provide me with a solution that is adherent to security practises to keep using your products.

Answer 1

Hello @Alexander Lindgren

Linux apps in App Service as a PaaS is developed with security best practices.
https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/app-service-security-baseline?toc=/azure/app-service/toc.json

Linux apps in App Service only supports SSH configuration with root user as it is used by App Service to let you access the SSH session with the container.

SSH access to Linux apps in App Service is secured with the following configuration:

• SSH is available only through the Kudu/SCM Site. The Kudu/SCM site is authenticated with your Azure account.
• Linux apps in App Service run in their own containers. No access to the host operating system is allowed, you do have root access to the container. Likewise, for apps running in Windows containers, you have administrative access to the container but no access to the host operating system.
• SSH configuration with root user doesn't allow external connections to the container.
• App Service uses port 2222 for SSH into the app's container, but that doesn't mean that port 2222 is exposed over the Internet. No matter how to use SSH in the app, all SSH traffic is handled through an endpoint on port 443.

https://stackoverflow.com/questions/69215797/docker-user-as-root-for-azure-app-service
https://learn.microsoft.com/en-us/answers/questions/495140/creating-a-non-root-user-and-web-ssh-cosole-login.html