Run without root

[JBlaschke]

Name and Version

bitnami/discourse:latest

What is the problem this feature will solve?

I am trying to run bitnami/discourse:latest on a shared kubernetes cluster. chroot is not allowed on that system due to security policy. Currently, I cannot launch discourse without getting: chroot: cannot change root directory to '/': Operation not permitted

What is the feature you are proposing to solve the problem?

To run discourse in non-privileged mode

What alternatives have you considered?

No response

[carrodher]

Bitnami containers are designed to operate as non-root by default. Consequently, any files or directories used by the application should be owned by the root group, as the random user (1001 by default) is a member of this root group. To ensure proper permissions, you'll need to adjust the ownership of your local directory accordingly.

For more comprehensive information about non-root containers and their significance for security, you can explore the following resources:

• Why non-root containers are important for security
• Use Non-Root Containers
• Work With Non-Root Containers for Bitnami Applications
• Running non-root containers on Openshift

These references provide valuable insights into the best practices and considerations when working with non-root containers in Bitnami applications.

[JBlaschke]

@carrodher thanks for the resources. I am looking for advice how to solve the chroot: cannot change root directory to '/': Operation not permitted problem.

Since security policy does not permit me to set the sys_chroot capability. Additionally, I need a solution that allows me to run the discourse container in non-privileged mode.

[carrodher]

The specific case of Discourse is one of the exceptions we need to maintain in our catalog. Given the nature of the application itself, the bitnami/discourse container doesn't support non-root. You can double-check this by taking a look at the Dockerfile, there is not a USER 1001 directive so the container is built and executed as root.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.