chpst -u app drops supplementary groups, breaking Docker socket and session access #22

New issue

Closed

opened 2026-08-04 11:24:22 +00:00 by geusebio · 0 comments

geusebio commented

2026-08-04 11:24:22 +00:00

Owner

/etc/services.d/frankenphp/run starts the server with chpst -u app, which sets only
uid and primary gid — it discards supplementary groups. Anything that works by adding
app to a group is therefore a silent no-op.

Observed on matthewbaggett/frankenphp:8.5
(sha256:793e376186016d74ee14c0cefc6c6908c3c6c1ead2b20305b92b4148b84b29f7):

$ docker run --rm --entrypoint sh matthewbaggett/frankenphp:8.5 -c 'addgroup app frankenphp; id app; chpst -u app id'
uid=1000(app) gid=1000(app) groups=1000(app),101(frankenphp)
uid=1000(app) gid=1000(app) groups=1000(app)

Why it matters

This is the root cause behind several separate-looking failures:

The Docker Engine API is unreachable from PHP. An app that bind-mounts
/var/run/docker.sock and adds app to the socket's owning group at entrypoint time
(the portable way to do it, since the gid is 0 on Docker Desktop and the docker gid on
a Linux host) gets nothing — the group is dropped before the server starts:
```
$ docker exec <ctr> chpst -u app curl -s --unix-socket /var/run/docker.sock http://localhost/version
(fails; same call as root or from a container that overrides CMD returns 200)
```
Sessions fail — see the companion issue about /var/lib/php-zts/session, which is
root:frankenphp 0770. Group membership cannot fix it while this stands.

Suggested fix

Use something that calls initgroups():

su-exec app frankenphp php-server -r /app/public
# or
setpriv --init-groups=always --reuid=app --regid=app frankenphp php-server -r /app/public

Either keeps supplementary groups, at which point group-based fixes start working as
written and no downstream image needs a workaround.

For contrast, matthewbaggett/php:8.5 (nginx + php-fpm) is unaffected: php-fpm drops to
app via initgroups(), so supplementary groups survive there.

`/etc/services.d/frankenphp/run` starts the server with `chpst -u app`, which sets only uid and primary gid — it **discards supplementary groups**. Anything that works by adding `app` to a group is therefore a silent no-op. Observed on `matthewbaggett/frankenphp:8.5` (`sha256:793e376186016d74ee14c0cefc6c6908c3c6c1ead2b20305b92b4148b84b29f7`): ``` $ docker run --rm --entrypoint sh matthewbaggett/frankenphp:8.5 -c 'addgroup app frankenphp; id app; chpst -u app id' uid=1000(app) gid=1000(app) groups=1000(app),101(frankenphp) uid=1000(app) gid=1000(app) groups=1000(app) ``` ### Why it matters This is the root cause behind several separate-looking failures: - **The Docker Engine API is unreachable from PHP.** An app that bind-mounts `/var/run/docker.sock` and adds `app` to the socket's owning group at entrypoint time (the portable way to do it, since the gid is 0 on Docker Desktop and the `docker` gid on a Linux host) gets nothing — the group is dropped before the server starts: ``` $ docker exec <ctr> chpst -u app curl -s --unix-socket /var/run/docker.sock http://localhost/version (fails; same call as root or from a container that overrides CMD returns 200) ``` - **Sessions fail** — see the companion issue about `/var/lib/php-zts/session`, which is `root:frankenphp 0770`. Group membership cannot fix it while this stands. ### Suggested fix Use something that calls `initgroups()`: ```sh su-exec app frankenphp php-server -r /app/public # or setpriv --init-groups=always --reuid=app --regid=app frankenphp php-server -r /app/public ``` Either keeps supplementary groups, at which point group-based fixes start working as written and no downstream image needs a workaround. For contrast, `matthewbaggett/php:8.5` (nginx + php-fpm) is unaffected: php-fpm drops to `app` via `initgroups()`, so supplementary groups survive there.

geusebio referenced this issue

2026-08-04 11:25:05 +00:00

Session directory is unwritable by the server user, so sessions silently never persist #23

geusebio referenced this issue

2026-08-04 11:25:08 +00:00

HOME=/root survives the privilege drop, so the embedded Mercure hub cannot start #24

geusebio referenced this issue from a pull request that will close it,

2026-08-04 12:27:27 +00:00

frankenphp: keep groups, HOME and the session dir across the privilege drop #31

geusebio closed this issue

2026-08-04 12:32:14 +00:00

geusebio referenced this issue