Containers always run as root: image USER is ignored and there is no runAsUser

Aperta
  • Qualcosa non va?
#3,245 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, go
Ambito
backend, infrastructure

Direzione di ricerca

The report names Container API securityContext and image layer unpacking, but no source files or tests. Start by locating container creation, runtime user and group handling, and the image layer extraction path; reproduce with an image declaring USER and the reported postgres or vault cases. Done means image USER is honored, runAsUser and runAsGroup are supported, and image layer ownership is preserved.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area/api area/gvisor area/microVM area/node area/security kind/feature

On v0.6.0 an image with USER redpanda runs as uid 0 in an actor, on both gVisor and microVM. The Container API has no runAsUser or runAsGroup.

Images whose entrypoint drops to a non-root user show more problems:

  • gVisor: the official postgres image fails with exec: "/usr/local/bin/docker-entrypoint.sh": stat /usr/local/bin/docker-entrypoint.sh: permission denied after CHOWN, SETUID and SETGID are added to securityContext.capabilities. Without them it fails earlier with chown: changing ownership of '/var/lib/postgresql/data': Operation not permitted. hashicorp/vault fails at su-exec: vault: Permission denied.
  • microVM: vault server -dev fails with open /home/vault/.vault-token.tmp: permission denied, although that directory belongs to the vault user in the image.

Request

  • Honor the image USER.
  • Add securityContext.runAsUser and runAsGroup.
  • Keep file ownership from image layers when they are unpacked.
Lingua principale
Go
Stelle
6.1k
Fork
676
Merge medio
2g 41m
PR unite (30g)
500

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agent-substrate/substrate

Tutte le issue di agent-substrate/substrate

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.