Permissions Granted to Function Execution Environments

Find out about the permissions granted to function execution environments with OCI Functions.

When a function you've deployed to OCI Functions is invoked, it runs in an execution environment (for example, an image-based function runs inside a container). The operations that the execution environment can perform are determined by the user ID (UID) and group ID (GID) specified when the environment is started. If a UID or GID is not specified, processes run as the root user, with all the default capabilities enabled.

When starting an execution environment to run a function, OCI Functions always specifies a user named 'fn' with a UID of 1000, and a group name 'fn' with a GID of 1000. No privileges are granted to UID 1000 and GID 1000, so the execution environment (and the function running in it) does not acquire default capabilities (for example, the default container capabilities listed in the Docker documentation). In addition, the execution environment is prevented from gaining privileges.

As a result, do not create and deploy functions that:

• depend on unavailable capabilities
• depend on privilege elevation (for example, su, sudo or setuid)

For image-based functions, if you're using your own Dockerfile, include the following lines:

groupadd --gid 1000 fn && \
adduser --uid 1000 --gid fn fn

For example:

FROM oraclelinux:7-slim

RUN  yum -y install oracle-release-el7 oracle-nodejs-release-el7 && \
     yum-config-manager --disable ol7_developer_EPEL && \
     yum -y install oracle-instantclient19.3-basiclite nodejs && \
     rm -rf /var/cache/yum && \
     groupadd --gid 1000 fn && \
     adduser --uid 1000 --gid fn fn

WORKDIR /function
ADD . /function/
RUN npm install

CMD exec node func.js

If you don't include the groupadd and adduser lines in the preceding example Dockerfile for an image-based function, you might see the following error message:

cx_Oracle.DatabaseError: ORA-12560: TNS:protocol adapter error