docs: keep the master's registry credentials private when running as nobody (#25)

2026-10-13 09:32:58 +02:00
parent a838777570
commit 9b9b3f9480
2 changed files with 11 additions and 9 deletions
@@ -13,10 +13,11 @@
 #   5. Optional, for registry polling of private images: put a config.json written by
 #      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config and
 #      uncomment DOCKER_CONFIG and the volumes entry below. The master runs as 65534:65534, so
-#      config.json must be readable by that user: `chmod 0644` it, or set `user:` below to the
-#      file owner's uid:gid. The directory must exist on every
-#      manager node (the master is placed on a manager), or Swarm rejects the task. Without
-#      it registries are accessed anonymously.
+#      the directory and config.json must be readable by that user while staying private:
+#      `chown -R 65534:65534 /path/to/docker-config` (keep 0700/0600), or set `user:` below
+#      to the owner's uid:gid. Do not make config.json world-readable; it holds registry
+#      passwords. The directory must exist on every manager node (the master is placed on a
+#      manager), or Swarm rejects the task. Without it registries are accessed anonymously.
 services:
  master:
    image: gitea.shcizo.se/shcizo/package-updater:latest