[Feature] Run the PD, Store and Server images as a non-root user
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker, helm, java, kubernetes
- Domain
- devops, infrastructure, security
Research direction
Locate the Dockerfiles and entrypoints for the PD, Store and Server images, then inspect how their data, log and temporary directories are created and used. Build each image and verify the Java process runs as the fixed user without permission errors; document the PVC upgrade note and ensure the Helm chart's security contexts can adopt the new defaults.
Written by the indexing model from the issue text.
Description
Feature Description (功能描述)
The published hugegraph/pd, hugegraph/store and hugegraph/server images all run their Java process as root: none of the three declares a USER, checked against the current latest image configs on Docker Hub (registry config blob, .config.User empty on all three, 2026-09-17).
Why it matters on Kubernetes:
- A namespace under the
restrictedPod Security Standard rejects these pods outright (runAsNonRoot != true). - The Helm chart in #3132 cannot set
runAsNonRoot: trueorreadOnlyRootFilesystem: trueas defaults; it documents this in its Limitations and ships the remaining hardening it can (allowPrivilegeEscalation: false,capabilities.drop: [ALL],seccompProfile: RuntimeDefault). - Security scanners (kube-score, polaris, kubescape) flag every workload for it, which any adopter evaluating the chart sees on day one; the 2026-09-10 chart test campaign recorded it as a failing kubescape NSA control on both branches.
Proposal:
- Create a fixed-UID user in each Dockerfile (the toolchain's Hubble image can follow the same pattern later) and
chownthe data and log directories to it. - Declare
USERin the image and keep the entrypoints from writing outside the data, log and temp directories, soreadOnlyRootFilesystembecomes possible as a follow-up. - Ship it in a minor release with an upgrade note: existing PVC data written as root needs a one-time
chown, or an initContainer /fsGroupnote in the chart.
The chart side is ready to adopt this the release it lands: podSecurityContext and securityContext are fully configurable per component today, so only the defaults would change.
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 640
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 19
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/hugegraph
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
apache/hugegraph#3231 · 1 comment ·
Maintainers usually reply within 2 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
apache/hugegraph#3142 · 7 comments ·
Maintainers usually reply within 2 days
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
Maintainers usually reply within 2 days
-
[Bug] Store IpUtil.getNearestAddress logs ERROR for hostname addresses and can return 127.0.0.1Open
Difficulty 3/5 1-2 days Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
apache/hugegraph#3254 · 1 comment ·
Maintainers usually reply within 2 days
All issues in apache/hugegraph
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
aoqia194/leaf-loader#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
apache/streampark#4521 ·
-
Update license yearOpen0 - Backlog 1 - Ready documentation good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
cbor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
FasterXML/jackson-dataformats-binary#844 ·
Maintainers usually reply within 1 day