Containers always run as root: image USER is ignored and there is no runAsUser

Open
  • Is something wrong?
#3,245 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, go
Domain
backend, infrastructure

Research direction

The report names Container API securityContext and image layer unpacking, but no source files or tests. Start by locating container creation, runtime user and group handling, and the image layer extraction path; reproduce with an image declaring USER and the reported postgres or vault cases. Done means image USER is honored, runAsUser and runAsGroup are supported, and image layer ownership is preserved.

Written by the indexing model from the issue text.

Description

area/api area/gvisor area/microVM area/node area/security kind/feature

On v0.6.0 an image with USER redpanda runs as uid 0 in an actor, on both gVisor and microVM. The Container API has no runAsUser or runAsGroup.

Images whose entrypoint drops to a non-root user show more problems:

  • gVisor: the official postgres image fails with exec: "/usr/local/bin/docker-entrypoint.sh": stat /usr/local/bin/docker-entrypoint.sh: permission denied after CHOWN, SETUID and SETGID are added to securityContext.capabilities. Without them it fails earlier with chown: changing ownership of '/var/lib/postgresql/data': Operation not permitted. hashicorp/vault fails at su-exec: vault: Permission denied.
  • microVM: vault server -dev fails with open /home/vault/.vault-token.tmp: permission denied, although that directory belongs to the vault user in the image.

Request

  • Honor the image USER.
  • Add securityContext.runAsUser and runAsGroup.
  • Keep file ownership from image layers when they are unpacked.
Dominant language
Go
Stars
5.9k
Forks
637
Avg merge
2d 1h
Merged PRs (30d)
523

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agent-substrate/substrate

All issues in agent-substrate/substrate

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.