Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: use the non-root atlantis user instead of root #3886

Merged
merged 20 commits into from
Nov 9, 2023
Merged

fix: use the non-root atlantis user instead of root #3886

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
d0b5c16
feat: use Atlantis user by default and get rid of gosu
bschaatsbergen Oct 21, 2023
be9a8d3
chore: set `DOCKER_CONTENT_TRUST=1`
bschaatsbergen Oct 21, 2023
da4d186
chore: fix chmod and chown
bschaatsbergen Oct 21, 2023
a9605b8
feat: add a healthcheck to the debian and alpine images
bschaatsbergen Oct 21, 2023
ef609e5
feat: removing setuid and setgid permissions prevents container privi…
bschaatsbergen Oct 21, 2023
4c6068f
chore: remove setgid/setuid as we chown an entire directory
bschaatsbergen Oct 21, 2023
6910d25
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
bschaatsbergen Oct 23, 2023
d3728c8
chore: keep deps comment generic
bschaatsbergen Oct 23, 2023
35f8a54
chore: grammar
bschaatsbergen Oct 23, 2023
a1f547c
chore: remove redundant comment
bschaatsbergen Oct 23, 2023
78d96cc
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
jamengual Oct 24, 2023
6230563
chore: rm DOCKER_CONTENT_TRUST
bschaatsbergen Oct 24, 2023
05638e3
Merge branch 'docker-use-atlantis-user-and-remove-gosu' of https://gi…
bschaatsbergen Oct 24, 2023
315f17e
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
bschaatsbergen Oct 29, 2023
378b857
chore: set uid and gid and remove passwd entry
bschaatsbergen Nov 4, 2023
cdef470
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
bschaatsbergen Nov 4, 2023
0029249
chore: revert gid and uid set as it's conflicting
bschaatsbergen Nov 5, 2023
fd89c0b
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
bschaatsbergen Nov 5, 2023
0767f62
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
jamengual Nov 7, 2023
c0bf56c
Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu
jamengual Nov 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 28 additions & 44 deletions Dockerfile
View file
Open in desktop
bschaatsbergen marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \

FROM debian:${DEBIAN_TAG} as debian-base

# Install packages needed for running Atlantis.
# Install packages needed to run Atlantis.
# We place this last as it will bust less docker layer caches when packages update
# hadolint ignore explanation
# DL3008 (pin versions using "=") - Ignored to avoid failing the build
Expand Down Expand Up @@ -89,30 +89,6 @@ RUN AVAILABLE_CONFTEST_VERSIONS=${DEFAULT_CONFTEST_VERSION} && \
rm checksums.txt; \
done

# install gosu
# We use gosu to step down from root and run as the atlantis user
# renovate: datasource=github-releases depName=tianon/gosu
ENV GOSU_VERSION=1.16

RUN case ${TARGETPLATFORM} in \
"linux/amd64") GOSU_ARCH=amd64 ;; \
"linux/arm64") GOSU_ARCH=arm64 ;; \
"linux/arm/v7") GOSU_ARCH=armhf ;; \
esac && \
curl -L -s --output gosu "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}" && \
curl -L -s --output gosu.asc "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}.asc" && \
for server in $(shuf -e ipv4.pool.sks-keyservers.net \
hkp://p80.pool.sks-keyservers.net:80 \
keyserver.ubuntu.com \
hkp://keyserver.ubuntu.com:80 \
pgp.mit.edu) ; do \
gpg --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
done && \
gpg --batch --verify gosu.asc gosu && \
chmod +x gosu && \
cp gosu /bin && \
gosu --version

bschaatsbergen marked this conversation as resolved.
Show resolved Hide resolved
# install git-lfs
# renovate: datasource=github-releases depName=git-lfs/git-lfs
ENV GIT_LFS_VERSION=3.4.0
Expand Down Expand Up @@ -159,26 +135,27 @@ RUN AVAILABLE_TERRAFORM_VERSIONS="1.3.10 1.4.6 1.5.7 ${DEFAULT_TERRAFORM_VERSION
# Creating the individual distro builds using targets
FROM alpine:${ALPINE_TAG} AS alpine

# atlantis user for gosu and OpenShift compatibility
EXPOSE ${ATLANTIS_PORT:-4141}
bschaatsbergen marked this conversation as resolved.
Show resolved Hide resolved

HEALTHCHECK --interval=5m --timeout=3s \
CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1

# Set up the 'atlantis' user and adjust permissions
RUN addgroup atlantis && \
adduser -S -G atlantis atlantis && \
adduser atlantis root && \
chown atlantis:root /home/atlantis/ && \
chmod g=u /home/atlantis/ && \
chmod g=u /etc/passwd
chmod u+rwx /home/atlantis/

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How come the chmod of /etc/passwd needs to change? If the line is removed, can atlantis still function?

Copy link
Member Author

@bschaatsbergen bschaatsbergen Oct 23, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the previous chmod g=u sets the group permissions for the /home/atlantis/ directory to be the same as the user's permissions.

The new chmod sets the user's permissions for the /home/atlantis/ directory to read, write (and execute).

So, the change here is that the original command was changing group permissions to match user permissions, and it has been modified to give the user explicit permissions instead.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right but I don't understand why /etc/passwd perms need to be changed. Can we get away with only changing /home/atlantis ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I didn't want to break anything. Therefor I just gave it read write permissions. We can't use g=u anymore though.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok no worries then, can always tackle it later. Thank you!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok but the more changes made, the more likely something can break. I'm all for more security, provided @bschaatsbergen has the appetite to keep going 🙏

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really the case? I'm happy to add it, but couldn't find it anywhere. I know that users start from 1000 though. Is there a particular reason we should explicitly set this? Omitting it would prevent a uid and gid conflict right? @jamengual

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've set uid/gid 100:1000 and removed the passwd entry lines.

Copy link

@arohter arohter Nov 7, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

alpine and debian have different uid's it appears: #3317 (comment)
alpine: uid=100, debian: uid=1000

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arohter it's removed again, to stay inline with what's in the Dockerfile now. to avoid touching the uid and gid at all.

# copy binary
# copy atlantis binary
COPY --from=builder /app/atlantis /usr/local/bin/atlantis
# copy terraform
# copy terraform binaries
COPY --from=deps /usr/local/bin/terraform* /usr/local/bin/
# copy deps
# copy dependencies
COPY --from=deps /usr/local/bin/conftest /usr/local/bin/conftest
COPY --from=deps /bin/gosu /bin/gosu
COPY --from=deps /usr/bin/git-lfs /usr/bin/git-lfs
# copy docker entrypoint
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
bschaatsbergen marked this conversation as resolved.
Show resolved Hide resolved

# Install packages needed for running Atlantis.
# Install packages needed to run Atlantis.
# We place this last as it will bust less docker layer caches when packages update
RUN apk add --no-cache \
ca-certificates~=20230506 \
Expand All @@ -191,29 +168,36 @@ RUN apk add --no-cache \
dumb-init~=1.2 \
gcompat~=1.1


# Set the entry point to the atlantis user and run the atlantis command
USER atlantis
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]

# Stage 2 - Debian
FROM debian-base AS debian

# Add atlantis user to Debian as well
EXPOSE ${ATLANTIS_PORT:-4141}

HEALTHCHECK --interval=5m --timeout=3s \
CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1

# Set up the 'atlantis' user and adjust permissions
RUN useradd --create-home --user-group --shell /bin/bash atlantis && \
adduser atlantis root && \
bschaatsbergen marked this conversation as resolved.
Show resolved Hide resolved
chown atlantis:root /home/atlantis/ && \
chmod g=u /home/atlantis/ && \
chmod g=u /etc/passwd
chmod u+rwx /home/atlantis/

# copy binary
# copy atlantis binary
COPY --from=builder /app/atlantis /usr/local/bin/atlantis
# copy terraform
# copy terraform binaries
COPY --from=deps /usr/local/bin/terraform* /usr/local/bin/
# copy deps
# copy dependencies
COPY --from=deps /usr/local/bin/conftest /usr/local/bin/conftest
COPY --from=deps /bin/gosu /bin/gosu
COPY --from=deps /usr/bin/git-lfs /usr/bin/git-lfs
# copy docker entrypoint
# copy docker-entrypoint.sh
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

# Set the entry point to the atlantis user and run the atlantis command
USER atlantis
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]
14 changes: 0 additions & 14 deletions docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,18 +29,4 @@ if ! whoami > /dev/null 2>&1; then
fi
fi

# If we're running as root and we're trying to execute atlantis then we use
# gosu to step down from root and run as the atlantis user.
# In OpenShift, containers are run as a random users so we don't need to use gosu.
if [ "$(id -u)" = 0 ] && [ "$1" = 'atlantis' ]; then
# If requested, set the capability to bind to privileged ports before
# we drop to the non-root user. Note that this doesn't work with all
# storage drivers (it won't work with AUFS).
if [ -n "${ATLANTIS_ALLOW_PRIVILEGED_PORTS+x}" ]; then
setcap "cap_net_bind_service=+ep" /bin/atlantis
fi

set -- gosu atlantis "$@"
fi

exec "$@"