SAS on OpenShift

[tenneyr]

I followed the instructions in the "Docker Toolkit for Data Scientists" PDF (link below), and got SAS working very well in Docker. However, my ultimate goal is to install SAS in OpenShift. Currently, OpenShift discourages the process of giving containers root privileges. Rather, a "random" user is assigned to the container and granted "least" privieldges to run under. I can get SAS to work in OpenShift if I do indeed give root privs to the container, however my organization will not let me deploy a production version configured this way. Is your team aware of this and are working on the problem or is there a workaround that I am not aware of?

https://www.sas.com/content/dam/SAS/support/en/sas-global-forum-proceedings/2018/1875-2018.pdf

[joeFurbee]

Hi tenneyr,

I checked with development and verified that SAS Analytics for Containers Docker image requires root privilege. I've asked a couple of follow up questions and will get back to you with any further information I am able to uncover on deployment on Openshift.

Regards,

Joe

[SimonDawson]

This requirement comes from the elssrv binary being setuid. It requires root permissions to launch processes as the correct user. If you just wanted to execute a SAS program you don't need root. You can create a docker image in a similar way to something like the the official python container where you'd take this container as a base the COPY in your program to form a new container you run with an updated entrypoint that executes SAS with the program as an argument.

What kind of SAS workload are you trying to deploy into OpenShift?

[tenneyr]

Thanks for the response. I somehow missed your reply. Sorry for the tardiness.

As for the Workload, SAS is used to provide "Reporting" services to our Java application. We connect to SAS via a SASIOMBridge using SAS's Java connectivity jar files. Custom SAS programs, based on parameters provided by the Java application, generate various types of reports for our end users. Running in OpenShift, we do not need individual user authentication but rather a single "application id" that all user requests funnel through. Our use of SAS is very minimal. For example, we do not need to the Web services compoents.