chore(lib-injection): use non-root user in image (#4490)

Containers using the root user can be blocked in Kubernetes which makes our lib injection image incompatible with certain Kubernetes configurations. The solution is to simply add and use a non-root user in the image.
DataDog · Nov 8, 2022 · 22fecd9 · 22fecd9
1 parent a23bc0a
commit 22fecd9
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/lib-injection/Dockerfile b/lib-injection/Dockerfile
@@ -2,7 +2,9 @@
 # and auto instrument Python applications in containerized environments.
 FROM busybox
 
+RUN addgroup -g 1000 -S datadog && \
+    adduser -u 1000 -S datadog -G datadog
+USER datadog
 WORKDIR /datadog-init
-
 ADD sitecustomize.py /datadog-init/sitecustomize.py
 ADD copy-lib.sh /datadog-init/copy-lib.sh
diff --git a/releasenotes/notes/lib-injection-user-19a5b5516c060d8b.yaml b/releasenotes/notes/lib-injection-user-19a5b5516c060d8b.yaml
@@ -0,0 +1,4 @@
+---
+other:
+  - |
+    Kubernetes library injection: run commands as non-root user.