Skip to content

Commit 1e5f085

Browse files
lfranckeNickLarsenNZ
lfrancke
and
NickLarsenNZ
authored
Make uid/gid configurable & change group of files - part 3 (#897)
* Make uid/gid configurable & change group of files This is a follow-up for #849 and includes: - The missing bits for Hive - Kafka * More tools now migrated but not tested yet: - Kafka Testing Tools - KCat - NiFi - Omid * - OPA - Spark (WIP) * Adds Spark and a changelog entry * - statsd_exporter - superset * - superset - tools * Adds Trino * Update CHANGELOG * Add Trino CLI * Add Vector * Add note * Update tools/Dockerfile Co-authored-by: Nick <[email protected]> * Update superset/Dockerfile Co-authored-by: Nick <[email protected]> * Update tools/Dockerfile Co-authored-by: Nick <[email protected]> * Update trino-cli/Dockerfile Co-authored-by: Nick <[email protected]> * Update trino-cli/Dockerfile Co-authored-by: Nick <[email protected]> * Update superset/Dockerfile Co-authored-by: Nick <[email protected]> * Fix CHANGELOG --------- Co-authored-by: Nick <[email protected]>
1 parent dff82c6 commit 1e5f085

File tree

20 files changed

+253
-80
lines changed

20 files changed

+253
-80
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ All notable changes to this project will be documented in this file.
3232
- Enable [Docker build checks](https://docs.docker.com/build/checks/) ([#872]).
3333
- java: migrate to temurin jdk/jre ([#894]).
3434
- tools: bump kubectl to `1.31.1` and jq to `1.7.1` ([#896]).
35-
- Make username, user id, group id configurable, use numeric ids everywhere, change group of all files to 0 ([#849], [#890]).
35+
- Make username, user id, group id configurable, use numeric ids everywhere, change group of all files to 0 ([#849], [#890], [#897]).
3636
- ci: Bump `stackabletech/actions` to 0.0.7 ([#901], [#903]).
3737

3838
### Removed
@@ -87,6 +87,7 @@ All notable changes to this project will be documented in this file.
8787
[#890]: https://github.com/stackabletech/docker-images/pull/890
8888
[#894]: https://github.com/stackabletech/docker-images/pull/894
8989
[#896]: https://github.com/stackabletech/docker-images/pull/896
90+
[#897]: https://github.com/stackabletech/docker-images/pull/897
9091
[#898]: https://github.com/stackabletech/docker-images/pull/898
9192
[#901]: https://github.com/stackabletech/docker-images/pull/901
9293
[#903]: https://github.com/stackabletech/docker-images/pull/903

‎airflow/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
135135
chmod -R g=u /stackable
136136
EOF
137137

138+
# ----------------------------------------
139+
# Attention: We are changing the group of all files in /stackable directly above
140+
# If you do any file based actions (copying / creating etc.) below this comment you
141+
# absolutely need to make sure that the correct permissions are applied!
142+
# chown ${STACKABLE_USER_UID}:0
143+
# ----------------------------------------
144+
138145
USER ${STACKABLE_USER_UID}
139146
WORKDIR /stackable
140147

‎druid/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
126126
chmod -R g=u /stackable
127127
EOF
128128

129+
# ----------------------------------------
130+
# Attention: We are changing the group of all files in /stackable directly above
131+
# If you do any file based actions (copying / creating etc.) below this comment you
132+
# absolutely need to make sure that the correct permissions are applied!
133+
# chown ${STACKABLE_USER_UID}:0
134+
# ----------------------------------------
135+
129136
USER ${STACKABLE_USER_UID}
130137
ENV PATH="${PATH}":/stackable/druid/bin
131138

‎hadoop/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,13 @@ EOF
177177

178178
COPY hadoop/licenses /licenses
179179

180+
# ----------------------------------------
181+
# Attention: We are changing the group of all files in /stackable directly above
182+
# If you do any file based actions (copying / creating etc.) below this comment you
183+
# absolutely need to make sure that the correct permissions are applied!
184+
# chown ${STACKABLE_USER_UID}:0
185+
# ----------------------------------------
186+
180187
USER ${STACKABLE_USER_UID}
181188

182189
ENV HOME=/stackable

‎hbase/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
362362
chmod -R g=u /stackable
363363
EOF
364364

365+
# ----------------------------------------
366+
# Attention: We are changing the group of all files in /stackable directly above
367+
# If you do any file based actions (copying / creating etc.) below this comment you
368+
# absolutely need to make sure that the correct permissions are applied!
369+
# chown ${STACKABLE_USER_UID}:0
370+
# ----------------------------------------
371+
365372
USER ${STACKABLE_USER_UID}
366373
ENV HBASE_CONF_DIR=/stackable/hbase/conf
367374
ENV HOME=/stackable

‎hello-world/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
2828
chmod -R g=u /stackable
2929
EOF
3030

31+
# ----------------------------------------
32+
# Attention: We are changing the group of all files in /stackable directly above
33+
# If you do any file based actions (copying / creating etc.) below this comment you
34+
# absolutely need to make sure that the correct permissions are applied!
35+
# chown ${STACKABLE_USER_UID}:0
36+
# ----------------------------------------
37+
3138
USER ${STACKABLE_USER_UID}
3239
WORKDIR /stackable
3340

‎hive/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,13 @@ EOF
142142
COPY --chown=${STACKABLE_USER_UID}:0 --from=hive-builder /stackable/jmx /stackable/jmx
143143
COPY hive/licenses /licenses
144144

145+
# ----------------------------------------
146+
# Attention: We are changing the group of all files in /stackable directly above
147+
# If you do any file based actions (copying / creating etc.) below this comment you
148+
# absolutely need to make sure that the correct permissions are applied!
149+
# chown ${STACKABLE_USER_UID}:0
150+
# ----------------------------------------
151+
145152
USER ${STACKABLE_USER_UID}
146153

147154
ENV HADOOP_HOME=/stackable/hadoop

‎kafka/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
102102
chmod -R g=u /stackable
103103
EOF
104104

105+
# ----------------------------------------
106+
# Attention: We are changing the group of all files in /stackable directly above
107+
# If you do any file based actions (copying / creating etc.) below this comment you
108+
# absolutely need to make sure that the correct permissions are applied!
109+
# chown ${STACKABLE_USER_UID}:0
110+
# ----------------------------------------
111+
105112
USER ${STACKABLE_USER_UID}
106113

107114
ENV PATH="${PATH}:/stackable/bin:/stackable/kafka/bin"

‎nifi/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
129129
chmod -R g=u /stackable
130130
EOF
131131

132+
# ----------------------------------------
133+
# Attention: We are changing the group of all files in /stackable directly above
134+
# If you do any file based actions (copying / creating etc.) below this comment you
135+
# absolutely need to make sure that the correct permissions are applied!
136+
# chown ${STACKABLE_USER_UID}:0
137+
# ----------------------------------------
138+
132139
USER ${STACKABLE_USER_UID}
133140

134141
ENV HOME=/stackable

‎omid/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
101101
chmod -R g=u /stackable
102102
EOF
103103

104+
# ----------------------------------------
105+
# Attention: We are changing the group of all files in /stackable directly above
106+
# If you do any file based actions (copying / creating etc.) below this comment you
107+
# absolutely need to make sure that the correct permissions are applied!
108+
# chown ${STACKABLE_USER_UID}:0
109+
# ----------------------------------------
110+
104111
USER ${STACKABLE_USER_UID}
105112
WORKDIR /stackable/omid-tso-server
106113

‎opa/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
133133
chmod -R g=u /stackable
134134
EOF
135135

136+
# ----------------------------------------
137+
# Attention: We are changing the group of all files in /stackable directly above
138+
# If you do any file based actions (copying / creating etc.) below this comment you
139+
# absolutely need to make sure that the correct permissions are applied!
140+
# chown ${STACKABLE_USER_UID}:0
141+
# ----------------------------------------
142+
136143
USER ${STACKABLE_USER_UID}
137144
WORKDIR /stackable/opa
138145

‎spark-k8s/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,13 @@ chown -R ${STACKABLE_USER_UID}:0 /stackable
328328
chmod -R g=u /stackable
329329
EOF
330330

331+
# ----------------------------------------
332+
# Attention: We are changing the group of all files in /stackable directly above
333+
# If you do any file based actions (copying / creating etc.) below this comment you
334+
# absolutely need to make sure that the correct permissions are applied!
335+
# chown ${STACKABLE_USER_UID}:0
336+
# ----------------------------------------
337+
331338
USER ${STACKABLE_USER_UID}
332339

333340
WORKDIR /stackable/spark

‎stackable-base/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ chown ${STACKABLE_USER_UID}:0 /stackable/.bashrc
155155
chown ${STACKABLE_USER_UID}:0 /stackable/.profile
156156

157157
cp /root/.curlrc /stackable/.curlrc
158-
chown stackable:0 /stackable/.curlrc
158+
chown ${STACKABLE_USER_UID}:0 /stackable/.curlrc
159159

160160
# CVE-2023-37920: Remove "e-Tugra" root certificates
161161
# e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems

‎statsd_exporter/Dockerfile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@
33

44
FROM stackable/image/stackable-base
55
ARG PRODUCT
6+
ARG STACKABLE_USER_UID
67

78
WORKDIR /statsd_exporter
89

9-
RUN --mount=type=cache,id=go-statsd-exporter,uid=1000,target=/go_cache <<EOF
10+
RUN --mount=type=cache,id=go-statsd-exporter,uid=${STACKABLE_USER_UID},target=/go_cache <<EOF
1011
microdnf update
1112

1213
# Tar and gzip are used to unpack the statsd_exporter source

‎superset/Dockerfile

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ FROM stackable/image/vector
8989
ARG PRODUCT
9090
ARG PYTHON
9191
ARG RELEASE
92+
ARG STACKABLE_USER_UID
9293

9394
LABEL name="Apache Superset" \
9495
maintainer="[email protected]" \
@@ -105,22 +106,37 @@ ENV FLASK_APP="superset.app:create_app()" \
105106
ENV PATH="${HOME}/app/bin:${PATH}" \
106107
PYTHONPATH="${HOME}/app/pythonpath"
107108

108-
RUN microdnf update \
109-
&& microdnf install \
110-
cyrus-sasl \
111-
openldap \
112-
openldap-clients \
113-
openssl-libs \
114-
openssl-pkcs11 \
115-
python${PYTHON} \
116-
&& microdnf clean all && \
117-
rm -rf /var/cache/yum
109+
RUN <<EOF
110+
microdnf update
111+
microdnf install \
112+
cyrus-sasl \
113+
openldap \
114+
openldap-clients \
115+
openssl-libs \
116+
openssl-pkcs11 \
117+
"python${PYTHON}"
118+
119+
microdnf clean all
120+
rm -rf /var/cache/yum
121+
122+
# All files and folders owned by root group to support running as arbitrary users.
123+
# This is best practice as all container users will belong to the root group (0).
124+
chown -R "${STACKABLE_USER_UID}:0" /stackable
125+
chmod -R g=u /stackable
126+
EOF
118127

119128
COPY superset/licenses /licenses
120129

121-
COPY --from=builder --chown=stackable:stackable /stackable/ ${HOME}/
130+
COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/
131+
132+
# ----------------------------------------
133+
# Attention: We are changing the group of all files in /stackable directly above
134+
# If you do any file based actions (copying / creating etc.) below this comment you
135+
# absolutely need to make sure that the correct permissions are applied!
136+
# chown ${STACKABLE_USER_UID}:0
137+
# ----------------------------------------
122138

123-
USER stackable
139+
USER ${STACKABLE_USER_UID}
124140
WORKDIR ${HOME}
125141

126142
CMD ["/bin/sh", "-c", \

‎tools/Dockerfile

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ ARG KUBECTL_VERSION
88
ARG RELEASE
99
ARG JQ_VERSION
1010
ARG TARGETARCH
11+
ARG STACKABLE_USER_UID
1112

1213
LABEL name="Stackable Tools" \
1314
maintainer="[email protected]" \
@@ -30,16 +31,30 @@ RUN microdnf update && \
3031

3132
COPY tools/licenses /licenses
3233

33-
USER stackable
3434
WORKDIR /stackable/bin
3535
ENV PATH=/stackable/bin:$PATH
3636

3737
# Get latest stable version from curl -L -s https://dl.k8s.io/release/stable.txt
38-
RUN curl https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl \
39-
-o /stackable/bin/kubectl && chmod +x /stackable/bin/kubectl
40-
41-
RUN curl https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64 \
42-
-o /stackable/bin/jq && \
43-
chmod +x /stackable/bin/jq
44-
45-
USER stackable
38+
RUN <<EOF
39+
curl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \
40+
-o /stackable/bin/kubectl
41+
chmod +x /stackable/bin/kubectl
42+
43+
curl "https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64" \
44+
-o /stackable/bin/jq
45+
chmod +x /stackable/bin/jq
46+
47+
# All files and folders owned by root group to support running as arbitrary users.
48+
# This is best practice as all container users will belong to the root group (0).
49+
chown -R ${STACKABLE_USER_UID}:0 /stackable
50+
chmod -R g=u /stackable
51+
EOF
52+
53+
# ----------------------------------------
54+
# Attention: We are changing the group of all files in /stackable directly above
55+
# If you do any file based actions (copying / creating etc.) below this comment you
56+
# absolutely need to make sure that the correct permissions are applied!
57+
# chown ${STACKABLE_USER_UID}:0
58+
# ----------------------------------------
59+
60+
USER ${STACKABLE_USER_UID}

‎trino-cli/Dockerfile

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ FROM stackable/image/java-base
55

66
ARG PRODUCT
77
ARG RELEASE
8+
ARG STACKABLE_USER_UID
89

910
LABEL name="Trino CLI" \
1011
maintainer="[email protected]" \
@@ -22,14 +23,27 @@ RUN microdnf update && \
2223
microdnf clean all && \
2324
rm -rf /var/cache/yum
2425

25-
USER stackable
26-
WORKDIR /stackable
2726

28-
COPY --chown=stackable:stackable trino-cli/licenses /licenses
27+
COPY --chown=${STACKABLE_USER_UID}:0 trino-cli/licenses /licenses
2928

3029
WORKDIR /stackable/trino-cli
3130

32-
RUN curl -O https://repo.stackable.tech/repository/packages/trino-cli/trino-cli-${PRODUCT}-executable.jar \
33-
&& ln -s trino-cli-${PRODUCT}-executable.jar trino-cli-executable.jar
31+
RUN <<EOF
32+
curl -O "https://repo.stackable.tech/repository/packages/trino-cli/trino-cli-${PRODUCT}-executable.jar"
33+
ln -s "trino-cli-${PRODUCT}-executable.jar" trino-cli-executable.jar
3434

35+
# All files and folders owned by root group to support running as arbitrary users.
36+
# This is best practice as all container users will belong to the root group (0).
37+
chown -R ${STACKABLE_USER_UID}:0 /stackable
38+
chmod -R g=u /stackable
39+
EOF
40+
41+
# ----------------------------------------
42+
# Attention: We are changing the group of all files in /stackable directly above
43+
# If you do any file based actions (copying / creating etc.) below this comment you
44+
# absolutely need to make sure that the correct permissions are applied!
45+
# chown ${STACKABLE_USER_UID}:0
46+
# ----------------------------------------
47+
48+
USER ${STACKABLE_USER_UID}
3549
ENTRYPOINT ["java", "-jar", "/stackable/trino-cli/trino-cli-executable.jar"]

0 commit comments

Comments
 (0)