feat: use non-root user for base-image

There is no need to use the root user. This allows the user to comply with pod security standards. Signed-off-by: Moritz Johner <[email protected]>
navinjoy · Mar 11, 2022 · 9ae8791 · 9ae8791
1 parent 72e2fab
commit 9ae8791
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/cluster-autoscaler/Dockerfile.amd64 b/cluster-autoscaler/Dockerfile.amd64
@@ -11,9 +11,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-ARG BASEIMAGE=gcr.io/distroless/static:latest-amd64
+ARG BASEIMAGE=gcr.io/distroless/static:nonroot-amd64
 FROM $BASEIMAGE
 LABEL maintainer="Marcin Wielgus <[email protected]>"
 
 COPY cluster-autoscaler-amd64 /cluster-autoscaler
+WORKDIR /
 CMD ["/cluster-autoscaler"]
diff --git a/cluster-autoscaler/Dockerfile.arm64 b/cluster-autoscaler/Dockerfile.arm64
@@ -11,9 +11,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-ARG BASEIMAGE=gcr.io/distroless/static:latest-arm64
+ARG BASEIMAGE=gcr.io/distroless/static:nonroot-arm64
 FROM $BASEIMAGE
 LABEL maintainer="Marcin Wielgus <[email protected]>"
 
 COPY cluster-autoscaler-arm64 /cluster-autoscaler
+WORKDIR /
 CMD ["/cluster-autoscaler"]