Answers: <p>The <a href="https://github.com/ncopa/su-exec" rel="nofollow noreferrer">su-exec</a> program in this script is actually the Alpine version created by Natanael Copa.</p>
  
  <p>It is installed from the OP's <a href="https://github.com/31z4/zookeeper-docker/blob/d5d320f94212691bd6e60326e45c152ac6784210/3.4.10/Dockerfile" rel="nofollow noreferrer">Dockerfile</a> on line 6.</p>
  
  <p>The Alpine su-exec program is a substitute for <a href="https://github.com/tianon/gosu" rel="nofollow noreferrer">gosu</a>. Both programs are used to enable execution of a command as a specific user with the same environment variables and permissions as would normally be available to the user. </p>
  
  <p>Thus you can effectively "step down" from root inside the container to run a specific command as a user and not as root.</p>
  
  <p>So the alternative solution in Ubuntu would be to install gosu itself, which has no dependencies, and in the <code>docker-entrypoint.sh</code> script use:</p>
  
  <pre><code>gosu "$ZOO_USER" "$@"
  </code></pre>
  
  <p>(as per @alexey-shrub's comment below)</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-20T14:56:45.030Z
Answers: gosu example: exec /usr/sbin/gosu theuser "$@"
Answers: Alexey Shrub
Answers: CC BY-SA 4.0
Answers: 2018-10-23T15:39:30.067Z
Answers: 2020-03-18T00:14:47.710Z
Answers: 2020-03-18T00:14:47.710Z
Answers: andreswebs
Answers: <h1>wrong argument order to <code>su</code></h1>
  
  <p><code>$ZOO_USER</code> needs to be the first argument to <code>su</code> with the <code>"$@"</code> coming afterwards.</p>
  
  <pre><code>su -c "$0" "$ZOO_USER" "$@"
  </code></pre>
  
  <p>It is ok for the options to come before the username.  It is a good idea to keep them in double quotes so that there aren't issues if someone accidentally puts spaces into it.</p>
  
  <p>Your error message reinforces that this is an order of arguments problem.</p>
  
  <h1>even better</h1>
  
  <p>Based on comments this would be even better:</p>
  
  <pre><code>su -c "$0" "$ZOO_USER" -- "$@"
  </code></pre>
  
  <h2>su man page excerpt</h2>
  
  <blockquote>
    <p>Additional arguments may be provided after the username, in which case they are supplied to the user's login shell. In particular, an argument of
    <code>-c</code> will cause the next argument to be treated as a command by most command interpreters. The command will be executed by the shell specified in <code>/etc/passwd</code> for the target user.</p>
    
    <p>You can use the <code>--</code> argument to separate <code>su</code> options from the arguments supplied to the shell.</p>
  </blockquote>
  
  <h2>busybox docs excerpt:</h2>
  
  <p>In a comment the OP asked about why this wouldn't work in Alpine Linux.  Since alpine is based on <code>busybox</code> I looked up the busybox docs. 
   According to the <a href="https://busybox.net/downloads/BusyBox.html" rel="nofollow noreferrer">docs busybox doesn't support</a> sending additional arguments to <code>su</code>:</p>
  
  <pre><code>su
  su [OPTIONS] [-] [username]
  
  Change user id or become root
  
  Options:
  
          -p, -m  Preserve environment
          -c CMD  Command to pass to 'sh -c'
          -s SH   Shell to use instead of default shell
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:24:21.177Z
Answers: ZOO_USER has to be the *last* argument to `su`, as such it's usually better, add `--` to separate su option from shell options of -c. I.e: `su -c "$0" "$ZOO_USER" --  "$@"` to avoid an argument of the command to be taken by `su`
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:25:16.267Z
Answers: Why does `$ZOO_USER` need to be the last argument?
Answers: chicks
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:25:35.060Z
Answers: From man page: `su [options] [username]`, as such `su -c command username -- remaining options to pass to command`
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:26:30.983Z
Answers: I've quoted a chunk of the man page above which supports my solution.
Answers: chicks
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:26:53.973Z
Answers: Yours also works, but it doesn't make mine wrong.
Answers: chicks
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:27:24.973Z
Answers: I agree with the solution, I've send the comment just before the edit :) That's jsut the first argument to su in your exemple is `-c` and not the username.
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:32:49.490Z
Answers: Btw the quote you used is more saying to do `su username -- -c command args` in fact. (nice catch for the order problem anyway, it didn't strike me when reading the question)
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-11-11T10:53:19.273Z
Answers: UPD - strange enough same command works with Ubuntu but not under Alpine Linux, bash as well https://github.com/bigdata-central/zookeeper-docker/blob/master/3.4.10/docker-entrypoint.sh. @Tensibai
Answers: Ta Mu
Answers: CC BY-SA 3.0
Answers: 2017-11-17T04:01:09.800Z
Answers: busybox `su` would be in Alpine Linux and it doesn't support additional arguments according to the docs.
Answers: chicks
Answers: CC BY-SA 3.0
Answers: 2017-11-10T16:19:03.023Z
Answers: 2017-11-17T04:01:53.687Z
Answers: 2017-11-17T04:01:53.687Z
Answers: chicks
Body: <p>In this <a href="https://github.com/31z4/zookeeper-docker/blob/d5d320f94212691bd6e60326e45c152ac6784210/3.4.10/docker-entrypoint.sh" rel="noreferrer">bash script</a> under Linux Alpine they have (line 8):</p>
  
  <pre><code>exec su-exec "$ZOO_USER" "$0" "$@"
  </code></pre>
  
  <p>As far as I know, <code>su-exec</code> is however an <a href="https://serverfault.com/questions/402418/how-to-change-suexec-root-directory-from-var-www-to-home">Apache httpd dependecy</a> - can I avoid it installing it under Ubuntu and use some more plain alternative?</p>
  
  <p>I have tested so far:</p>
  
  <pre><code> su -c "$0 $@" $ZOO_USER
  </code></pre>
  
  <p>But then the call through Docker <a href="https://docs.docker.com/engine/reference/builder/#cmd" rel="noreferrer"><code>CMD</code></a> shows that I might have some sort of escaping/quotes error,</p>
  
  <pre><code>CMD ["zkServer.sh", "start-foreground"]
  </code></pre>
  
  <p>resulting in the following output; obviously there is a misplacement for the username field in the command sequence. </p>
  
  <pre><code>No passwd entry for user 'start-foreground'
  </code></pre>
  
  <p>But what is then the difference to the original (su-exec), which works fine? And how to get it right with <code>su</code>?</p>
  
  <p>====</p>
  
  <p>UPD: su-exec is here a third-parthy Alpine Linux package
  <a href="https://github.com/ncopa/su-exec" rel="noreferrer">https://github.com/ncopa/su-exec</a></p>
  
Tags: <docker><bash>
Title: Interference of Docker CMD with su: works with su-exec but not with su?
UserDisplayName: Ta Mu
ThreadText: # Interference of Docker CMD with su: works with su-exec but not with su?
  
  (Asked by: username_0 on 2017-11-10)
  
  In this [bash script](https://github.com/31z4/zookeeper-docker/blob/d5d320f94212691bd6e60326e45c152ac6784210/3.4.10/docker-entrypoint.sh) under Linux Alpine they have (line 8):
  
  ```
  exec su-exec "$ZOO_USER" "$0" "$@"
  
  ```
  
  As far as I know, `su-exec` is however an [Apache httpd dependecy](https://serverfault.com/questions/402418/how-to-change-suexec-root-directory-from-var-www-to-home) - can I avoid it installing it under Ubuntu and use some more plain alternative?
  
  I have tested so far:
  
  ```
   su -c "$0 $@" $ZOO_USER
  
  ```
  
  But then the call through Docker [`CMD`](https://docs.docker.com/engine/reference/builder/#cmd) shows that I might have some sort of escaping/quotes error,
  
  ```
  CMD ["zkServer.sh", "start-foreground"]
  
  ```
  
  resulting in the following output; obviously there is a misplacement for the username field in the command sequence.
  
  ```
  No passwd entry for user 'start-foreground'
  
  ```
  
  But what is then the difference to the original (su-exec), which works fine? And how to get it right with `su`?
  
  ====
  
  UPD: su-exec is here a third-parthy Alpine Linux package
  <https://github.com/ncopa/su-exec>
  
  **Tags:** docker, bash
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2017-11-10. Score: 6 | Accepted answer
  
  # wrong argument order to `su`
  
  `$ZOO_USER` needs to be the first argument to `su` with the `"$@"` coming afterwards.
  
  ```
  su -c "$0" "$ZOO_USER" "$@"
  
  ```
  
  It is ok for the options to come before the username. It is a good idea to keep them in double quotes so that there aren't issues if someone accidentally puts spaces into it.
  
  Your error message reinforces that this is an order of arguments problem.
  
  # even better
  
  Based on comments this would be even better:
  
  ```
  su -c "$0" "$ZOO_USER" -- "$@"
  
  ```
  
  ## su man page excerpt
  
  > Additional arguments may be provided after the username, in which case they are supplied to the user's login shell. In particular, an argument of
  > `-c` will cause the next argument to be treated as a command by most command interpreters. The command will be executed by the shell specified in `/etc/passwd` for the target user.
  >
  > You can use the `--` argument to separate `su` options from the arguments supplied to the shell.
  
  ## busybox docs excerpt:
  
  In a comment the OP asked about why this wouldn't work in Alpine Linux. Since alpine is based on `busybox` I looked up the busybox docs.
  According to the [docs busybox doesn't support](https://busybox.net/downloads/BusyBox.html) sending additional arguments to `su`:
  
  ```
  su
  su [OPTIONS] [-] [username]
  
  Change user id or become root
  
  Options:
  
          -p, -m  Preserve environment
          -c CMD  Command to pass to 'sh -c'
          -s SH   Shell to use instead of default shell
  
  ```
  
  > **Comments:**
  > **username_4**: ZOO_USER has to be the *last* argument to `su`, as such it's usually better, add `--` to separate su option from shell options of -c. I.e: `su -c "$0" "$ZOO_USER" --  "$@"` to avoid an argument of the command to be taken by `su`  
  > **username_3**: Why does `$ZOO_USER` need to be the last argument?  
  > **username_4**: From man page: `su [options] [username]`, as such `su -c command username -- remaining options to pass to command`  
  > **username_3**: I've quoted a chunk of the man page above which supports my solution.  
  > **username_3**: Yours also works, but it doesn't make mine wrong.  
  > **username_4**: I agree with the solution, I've send the comment just before the edit :) That's jsut the first argument to su in your exemple is `-c` and not the username.  
  > **username_4**: Btw the quote you used is more saying to do `su username -- -c command args` in fact. (nice catch for the order problem anyway, it didn't strike me when reading the question)  
  > **username_0**: UPD - strange enough same command works with Ubuntu but not under Alpine Linux, bash as well https://github.com/bigdata-central/zookeeper-docker/blob/master/3.4.10/docker-entrypoint.sh. @username_4  
  > **username_3**: busybox `su` would be in Alpine Linux and it doesn't support additional arguments according to the docs.  
  
  ---
  
  ### Answer by username_1 on 2018-10-23. Score: 3
  
  The [su-exec](https://github.com/ncopa/su-exec) program in this script is actually the Alpine version created by Natanael Copa.
  
  It is installed from the OP's [Dockerfile](https://github.com/31z4/zookeeper-docker/blob/d5d320f94212691bd6e60326e45c152ac6784210/3.4.10/Dockerfile) on line 6.
  
  The Alpine su-exec program is a substitute for [gosu](https://github.com/tianon/gosu). Both programs are used to enable execution of a command as a specific user with the same environment variables and permissions as would normally be available to the user.
  
  Thus you can effectively "step down" from root inside the container to run a specific command as a user and not as root.
  
  So the alternative solution in Ubuntu would be to install gosu itself, which has no dependencies, and in the `docker-entrypoint.sh` script use:
  
  ```
  gosu "$ZOO_USER" "$@"
  
  ```
  
  (as per @username_2's comment below)
  
  > **Comments:**
  > **username_2**: gosu example: exec /usr/sbin/gosu theuser "$@"  
  
  ---
  
  