envoyproxy/envoy

Envoy shouldn't run as root.

Open

#17,610 opened on Aug 5, 2021

View on GitHub
 (2 comments) (0 reactions) (1 assignee)C++ (5,373 forks)batch import
area/dockerhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Description: Some organizations have podsecuritypolicies that prevent containers from running as root.

https://github.com/envoyproxy/envoy/blob/main/ci/docker-entrypoint.sh#L27 https://github.com/envoyproxy/envoy/blob/main/ci/Dockerfile-envoy#L26

After reading the dockerfile and entrypoint script it seems that the container starts off as root but later su-execs to be the envoy user. This isn't good enough for Kubernetes which still sees a container being started as root.

Is there ever a reason to allow Envoy to run as root rather than just doing the logic of the entrypoint script right in the dockerfile with a USER envoy directive?

[optional Relevant Links:] In the knative kourier project envoy is leveraged but envoy is ran as root https://github.com/knative-sandbox/net-kourier/pull/593 https://github.com/knative/operator/issues/710

Contributor guide

Research direction
Modify the Dockerfile to add USER envoy directive and update the entrypoint script to avoid running as root. Ensure the entrypoint does not require root privileges for any operation.
Tech stack
docker
Domain
securitybackend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
DockerKubernetes
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70