Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Non-root containers #1274

Merged
merged 2 commits into from
Nov 6, 2023
Merged

Non-root containers #1274

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6fc76d
Use non-root user for tests container
douglascamata Oct 31, 2023
4f72a91
Tighten container permissions
douglascamata Oct 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions collectors/metrics/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@ RUN microdnf update &&\
mkdir /licenses &&\
microdnf clean all

USER 1001:1001

COPY --from=builder /workspace/metrics-collector /usr/bin/

# standalone required parameters
Expand Down
2 changes: 2 additions & 0 deletions loaders/dashboards/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ WORKDIR /

RUN microdnf update -y && microdnf clean all

USER 1001:1001

COPY --from=builder /workspace/main grafana-dashboard-loader

EXPOSE 3002
Expand Down
2 changes: 2 additions & 0 deletions operators/multiclusterobservability/bundle.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
FROM scratch

USER 1001:1001

LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
Expand Down
3 changes: 3 additions & 0 deletions proxy/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,9 @@ LABEL org.label-schema.vendor="Red Hat" \
io.openshift.tags="$IMAGE_OPENSHIFT_TAGS"

WORKDIR /

USER 1001:1001

COPY --from=builder /workspace/main rbac-query-proxy

EXPOSE 3002
Expand Down
4 changes: 2 additions & 2 deletions tests/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ RUN go install github.com/onsi/ginkgo/[email protected] && go mod vendor && ginkgo
# create new docker image to hold built artifacts
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest

# run as root
USER root
# run as non-root
USER 1001:1001

# expose env vars for runtime
ENV KUBECONFIG "/opt/.kube/config"
Expand Down
2 changes: 1 addition & 1 deletion tools/simulator/metrics-collector/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest

USER 1001:1001
COPY timeseries.txt /tmp/
5 changes: 3 additions & 2 deletions tools/simulator/metrics-collector/metrics-extractor/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,11 @@ RUN microdnf install wget -y \
RUN microdnf install tar gzip jq bc -y\
&& microdnf clean all

USER 1001:1001

RUN wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable-4.13/openshift-client-linux.tar.gz -P /ocp-tools
WORKDIR /ocp-tools
RUN chmod 777 /ocp-tools
RUN chmod 644 /ocp-tools
RUN tar xvf openshift-client-linux.tar.gz oc kubectl
RUN rm openshift-client-linux.tar.gz
RUN cp oc /usr/local/bin
Expand All @@ -38,7 +39,7 @@ RUN export matches=$(curl -L $METRICS_ALLOW_LIST_URL | $GOJSONTOYAML_BIN --yamlt


COPY ./extract-metrics-data.sh /metrics-extractor/
RUN chmod 777 /metrics-extractor
RUN chmod 744 /metrics-extractor


CMD [ "/bin/bash", "/metrics-extractor/extract-metrics-data.sh" ]
Loading