Skip to content

Run ActiveMQ container as a non-root user#1648

Closed
pradeep85841 wants to merge 5 commits intoapache:mainfrom
pradeep85841:feature/non-root-user
Closed

Run ActiveMQ container as a non-root user#1648
pradeep85841 wants to merge 5 commits intoapache:mainfrom
pradeep85841:feature/non-root-user

Conversation

@pradeep85841
Copy link
Contributor

Summary

This PR modifies the Dockerfile to run the ActiveMQ container
as a dedicated non-root user, improving security and following
Docker best practices.

Changes

  • Added 'activemq' user and group
  • Ensured all ActiveMQ directories are owned by this user
  • Dropped root privileges before starting the broker
  • Adjusted permissions of entrypoint script

Testing

  • Verified container starts successfully
  • Verified ActiveMQ process runs as 'activemq' user:
    docker exec -it <container> ps -ef | grep java
    docker exec -it <container> whoami
    docker exec -it <container_name_or_id> ls -l /usr/local/bin/entrypoint.sh

Pradeep Kunchala added 5 commits January 26, 2026 18:14
- HEALTHCHECK uses Jolokia search on Broker MBean
- Ensures broker is running and accessible
- Auth and Origin headers included for Jolokia security
- Docker CI-ready and deterministic
- Create a dedicated 'activemq' user and group
- Ensure ActiveMQ home directory is owned by this user
- Drop root privileges before starting the broker

This improves container security by avoiding running the process as root,
aligning with Docker best practices.
@jbonofre
Copy link
Member

jbonofre commented Feb 3, 2026

FYI a similar PR has been created a few months ago. I will take a look on this one.

@jeanouii
Copy link
Contributor

jeanouii commented Feb 3, 2026

The test has been merged already as part of the other PR. So you probably want to rebase this one.
I probably would have created an issue in JIRA and close the other PR, because they are both targeting the same file essentially improving Docker capabilities. They rely anyways on each other.

What do you think?

@jbonofre jbonofre self-requested a review February 3, 2026 12:13
@pradeep85841
Copy link
Contributor Author

Thanks, that’s helpful. I’ll rebase this PR on top of the merged changes so it aligns with the current Docker improvements. Let me know if you’d prefer a different approach.

@jbonofre
Copy link
Member

jbonofre commented Feb 3, 2026

@pradeep85841 I gonna review the PR tomorrow. Thanks !

@jbonofre
Copy link
Member

FYI, here's the corresponding Jira: https://issues.apache.org/jira/browse/AMQ-9588

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unrelated to the Docker image.

Can you please remove this file from the PR ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR should have been rebased but it won't matter to much here because the test was part of another PR that got merged last week #1631
I think we are good to go.

@jbonofre
Copy link
Member

jbonofre commented Feb 11, 2026

Superseded by #1665

@jbonofre jbonofre closed this Feb 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants