make cluster-api-manager container run with a non-root user (#955)

kubernetes-sigs · Jun 4, 2019 · ee3a60b · ee3a60b
1 parent 2ec4561
commit ee3a60b
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -18,7 +18,7 @@ FROM golang:1.12.5 as builder
 ARG ARCH
 
 # Copy in the go src
-WORKDIR $GOPATH/src/sigs.k8s.io/cluster-api
+WORKDIR ${GOPATH}/src/sigs.k8s.io/cluster-api
 COPY pkg/    pkg/
 COPY cmd/    cmd/
 COPY vendor/ vendor/
@@ -30,4 +30,5 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -a -ldflags '-extldflags "-
 FROM gcr.io/distroless/static:latest
 WORKDIR /
 COPY --from=builder /go/src/sigs.k8s.io/cluster-api/manager .
+USER nobody
 ENTRYPOINT ["/manager"]