fix(telegraf): Correct supplementary group handling when dropping privileges

telegraf/1.37/alpine/Dockerfile

@@ -34,7 +34,10 @@ RUN ARCH= && \
     apk del .build-deps && \
     addgroup -S telegraf && \
     adduser -S telegraf -G telegraf && \
-    chown -R telegraf:telegraf /etc/telegraf
+    chown -R telegraf:telegraf /etc/telegraf && \
+    # drop root from the base image default supplementary groups (bin, disk,
+    # video, ...) so they are not granted to container processes at runtime
+    for g in $(id -Gn root); do [ "$g" = 'root' ] || delgroup root "$g"; done
 
 EXPOSE 8125/udp 8092/udp 8094
 

telegraf/1.37/alpine/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/1.37/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/1.38/alpine/Dockerfile

@@ -34,7 +34,10 @@ RUN ARCH= && \
     apk del .build-deps && \
     addgroup -S telegraf && \
     adduser -S telegraf -G telegraf && \
-    chown -R telegraf:telegraf /etc/telegraf
+    chown -R telegraf:telegraf /etc/telegraf && \
+    # drop root from the base image default supplementary groups (bin, disk,
+    # video, ...) so they are not granted to container processes at runtime
+    for g in $(id -Gn root); do [ "$g" = 'root' ] || delgroup root "$g"; done
 
 EXPOSE 8125/udp 8092/udp 8094
 

telegraf/1.38/alpine/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/1.38/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/1.39/alpine/Dockerfile

@@ -34,7 +34,10 @@ RUN ARCH= && \
     apk del .build-deps && \
     addgroup -S telegraf && \
     adduser -S telegraf -G telegraf && \
-    chown -R telegraf:telegraf /etc/telegraf
+    chown -R telegraf:telegraf /etc/telegraf && \
+    # drop root from the base image default supplementary groups (bin, disk,
+    # video, ...) so they are not granted to container processes at runtime
+    for g in $(id -Gn root); do [ "$g" = 'root' ] || delgroup root "$g"; done
 
 EXPOSE 8125/udp 8092/udp 8094
 

telegraf/1.39/alpine/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/1.39/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/nightly/alpine/Dockerfile

@@ -24,7 +24,10 @@ RUN ARCH= && \
     apk del .build-deps && \
     addgroup -S telegraf && \
     adduser -S telegraf -G telegraf && \
-    chown -R telegraf:telegraf /etc/telegraf
+    chown -R telegraf:telegraf /etc/telegraf && \
+    # drop root from the base image default supplementary groups (bin, disk,
+    # video, ...) so they are not granted to container processes at runtime
+    for g in $(id -Gn root); do [ "$g" = 'root' ] || delgroup root "$g"; done
 
 EXPOSE 8125/udp 8092/udp 8094
 

telegraf/nightly/alpine/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi

telegraf/nightly/entrypoint.sh

@@ -14,16 +14,11 @@ else
     # ensure HOME is set to the telegraf user's home dir
     export HOME=$(getent passwd telegraf | cut -d : -f 6)
 
-    # honor groups supplied via 'docker run --group-add ...' but drop 'root'
-    # (also removes 'telegraf' since we unconditionally add it and don't want it listed twice)
+    # combine the telegraf user's own groups, so memberships baked into
+    # /etc/group are kept (as su-exec's initgroups did), with any supplied via
+    # 'docker run --group-add ...', then drop 'root' and any duplicates
     # see https://github.com/influxdata/influxdata-docker/issues/724
-    groups="telegraf"
-    extra_groups="$(id -Gn || true)"
-    for group in $extra_groups; do
-        case "$group" in
-            root | telegraf) ;;
-            *) groups="$groups,$group" ;;
-        esac
-    done
+    groups="$(printf '%s %s' "$(id -Gn telegraf)" "$(id -Gn || true)" \
+        | tr ' ' '\n' | grep -vx root | sort -u | paste -sd, -)"
     exec setpriv --reuid telegraf --regid telegraf --groups "$groups" "$@"
 fi