Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Golang Service Orchestrator (Executor) fails to replace variables since no longer runs root #1955

Closed
axsaucedo opened this issue Jun 15, 2020 · 3 comments · Fixed by #1956
Closed
Assignees
Labels
bug triage Needs to be triaged and prioritised accordingly
Milestone

Comments

@axsaucedo
Copy link
Contributor

Currently we have changed such that the container doesn't run as root which brings benefits on security. This causes an error as the golang executor is no longer able to replace the variables on startup on the openapi files. The container runs with user 8888 so currently the solution would be change the owner of the directory to be user with ID 8888.

@axsaucedo axsaucedo added bug triage Needs to be triaged and prioritised accordingly labels Jun 15, 2020
@axsaucedo axsaucedo self-assigned this Jun 15, 2020
@axsaucedo axsaucedo added this to the 1.2 milestone Jun 15, 2020
@ukclivecox
Copy link
Contributor

It would be better to make the files globally writable maybe as the RedHat ubi image runs as 1001 user by default and may run as an arbitrary user provided at runtime by openshift.

@axsaucedo
Copy link
Contributor Author

I completely agree, the main problems is that because we've also moved the distroless it's not possible to run the chmod command, so it's not possible to change permissions... the only command available seems to be --chown when using the docker COPY command, which is the suggested approach as well in the distroless issues, I can try to see if there are other ways to add chmod for files on distroless

@axsaucedo
Copy link
Contributor Author

@cliveseldon ok it seems it was possible to achieve this by changing the chmod on the builder container and copying the files with the broad access permissions. #1956 should have the fix now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug triage Needs to be triaged and prioritised accordingly
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants