Permissions for Collabora on Openshift 4.19.18

Installation & Configuration
1

I am having trouble getting Collabora to work under Openshift 4.19 due to security standards. All the documentation I find seems to center around OpenShift 3 and the issues with routes / HAProxy / nginx , but I have yet to find anything about setting up a service account or what permissions are needed. Is there a recommended SCC for use with Collabora ?

Using the standard helm chart, the pod ends with this error:

wsd-00001-00001 2025-11-13 19:31:53.135117 +0000 [ coolwsd ] FTL Failed to initialize COOLWSD: Access to file denied: /opt/cool/child-roots/1-476bd716| wsd/COOLWSD.hpp:263
Access to file denied: /opt/cool/child-roots/1-476bd716

Trying to add in the security contexts the AIO repo defines gives me this warning and doesn’t actually run anything.

Warning: would violate PodSecurity “restricted:latest”: allowPrivilegeEscalation != false (container “collabora” must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container “collabora” must set securityContext.capabilities.drop=[“ALL”]; container “collabora” must not include “CAP_SYS_ADMIN”, “MKNOD” in securityContext.capabilities.add), runAsNonRoot != true (pod or container “collabora” must set securityContext.runAsNonRoot=true), seccompProfile (pod or container “collabora” must set securityContext.seccompProfile.type to “RuntimeDefault” or “Localhost”)

All the documentation I find seems to center around OpenShift 3 and the issues with routes / HAProxy / nginx , but I have yet to find anything about setting up a service account or what permissions are needed.

Are there any guides in this area ?

2

Hii @ccandreva welcome back to COOL forums :slight_smile:

OpenShift’s built-in router is a minimized HAProxy that doesn’t support all the advanced features Collabora Online needs. That’s why most older docs mention OpenShift 3 workarounds with routes or external proxies.

On OpenShift 4 the same limitation still applies. COOL requires advanced HAProxy annotations and behavior that the OpenShift Router can’t provide. Because of that the recommended approach is to deploy a full HAProxy Ingress inside the Collabora namespace rather than relying on the OpenShift router.

So yes, OpenShift and “HAProxy in Kubernetes” are different. The OpenShift router is a limited, security-hardened version intended only to serve as a general ingress controller, while the HAProxy Ingress project is the full upstream version with all the features COOL depends on.

Once you deploy a proper HAProxy Ingress, Collabora runs normally without needing special SCCs or elevated privileges. The main issue isn’t permissions, it’s that the OpenShift router is missing features COOL expects.

Thanks
Darshan

3

Hi Darshan - thanks for the reply ! I think I confused the issue. I’m not at that point yet, the Collabora pod is in Crash/ Backoff because of permissions on /opt/cool/child-roots.

Doing more reading I think this boils down to Collabora wanting a container running as root and OpenShift very much not wanting containers to run as root ?

4

The solution to my problem was running using a service account with the anyuid policy. Also if I understand correctly, the advanced annotations are necessary to direct people editing the same document to the same pod ? If so - I’m migrating from a single podman instance behind an Apache reverse proxy , so I have it working in a very simple setup with a single route.
For anyone having trouble with the permissions, this is what I needed for a small, simple setup:

oc new-project collabora oc project collabora oc create sa collabora-sa -n collabora oc adm policy add-scc-to-user anyuid -z collabora-sa -n collabora oc apply -f ./collabora-deployment.yaml oc apply -f ./collabora-service.yaml

Collabora-deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
name: collabora
labels:
app: collabora

spec:
replicas: 1
selector:
matchLabels:
app: collabora
template:
metadata:
labels:
app: collabora
spec:
serviceAccountName: collabora-sa
containers:
- name: collabora
image: docker.io/collabora/code:latest
env:
- name: aliasgroup1
value: “https://app.example.com:443,https://app\\.example\\.com:443”
- name: extra_params
value: “–o:ssl.enable=false --o:ssl.termination=true”
- name: DONT_GEN_SSL_CERT
value: “true”
- name: TZ
value: America/New_York
ports:
- protocol: TCP
containerPort: 9980

collabora-service.yaml

piVersion: v1
kind: Service
metadata:
name: collabora
labels:
app: collabora

spec:
ports:

name: “9980”
port: 9980
targetPort: 9980
selector:
app: collabora

And the dead simple route that seems to work for 1 container:

oc create route edge 
–cert=cert.pem
–key=cert.key
–hostname=collabora.example.com 
–port=9980 --path=/ --service=collabora 
–insecure-policy=‘Redirect’
1 Like