chore: use non-root user for alpine images #34162
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #34162 +/- ##
============================================
+ Coverage 59.37% 75.85% +16.47%
============================================
Files 2819 514 -2305
Lines 67691 22353 -45338
Branches 15036 5426 -9610
============================================
- Hits 40192 16955 -23237
+ Misses 24682 4744 -19938
+ Partials 2817 654 -2163
Flags with carried forward coverage won't be shown. Click here to find out more. |
debdutdeb
changed the title
| # `nogroup` group is historically reserved for NFS. | ||
| # We don't use any NFS related tools in this image. | ||
| # For the same reason of NFS using the gid, we can also use it as long as there are no conflicts in terms of running processes with the same egid (which is 1 in our case). | ||
| # While 65533 raw gid could be used, renaming nogroup to rocketchat here for maximum compatibility with older debian image. | ||
| # More info on nobody/nogroup - https://wiki.ubuntu.com/nobody | ||
| # Debian wiki - https://wiki.debian.org/SystemGroups | ||
| # """ | ||
| # daemon: Some unprivileged daemons that need to write to files on disk run as daemon.daemon (e.g., portmap, atd, probably others). | ||
| # Daemons that don't need to own any files can run as nobody.nogroup instead, | ||
| # and more complex or security conscious daemons run as dedicated users. | ||
| # The daemon user is also handy for locally installed daemons. | ||
| # """ |
There was a problem hiding this comment.
may seem like an over-explanation, open to removing.
| groupmod -n rocketchat nogroup && \ | ||
| useradd -u 65533 -r -g rocketchat rocketchat && \ | ||
| apk del deps && \ | ||
| chown -R rocketchat:rocketchat /app |
There was a problem hiding this comment.
we could add --chown to all COPYs, however, it's not really that many files, one could argue that with COPY --chown it will build faster, but that number hasn't been noticeable. this way, we dont have to do many USER switching shenanigans.
|
because you moved the |
Proposed changes (including videos or screenshots)
Issue(s)
Steps to test or reproduce
Further comments
VLN-82