Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run whereabouts container as non-root user #554

Open
ethaeris opened this issue Jan 30, 2025 · 0 comments
Open

Run whereabouts container as non-root user #554

ethaeris opened this issue Jan 30, 2025 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@ethaeris
Copy link

Is your feature request related to a problem? Please describe.
A security scan of whereabouts indicates that the container's user is root. Generally speaking, this is not a good security practice.

Describe the solution you'd like
Use Docker USER instructions in the Dockerfile(s) to have the container run as a non-root user.
My assumption is that this will require a small number of extra privileges, since the install-cni.sh script needs to copy files to the host.

Describe alternatives you've considered
An initContainer may be an alternative to copying files to the host. This may require maintaining additional images as part of this project; security scans may still flag those initContainer images as running as the root user.

Using a Kubernetes security context would allow Kubernetes to run the whereabouts container as a non-root user. Security scans would still flag the whereabouts image as running as the root user, even though Kubernetes would run the container as non-root.

@ethaeris ethaeris added the enhancement New feature or request label Jan 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants