Bladeren bron

Resolve opencost-ui container running as root

CIS Kubernetes v1.23 advises in 5.2.7 to not run containers as root where not needed. Namespaces in K8S distros like RKE2 by default deny the ability to run as root. 

This fixes the container so it'll run as a non-root user by default.

Signed-off-by: David Jericho <davidj@diskpig.org>
David Jericho 2 jaren geleden
bovenliggende
commit
690932033d
1 gewijzigde bestanden met toevoegingen van 8 en 1 verwijderingen
  1. 8 1
      ui/Dockerfile.cross

+ 8 - 1
ui/Dockerfile.cross

@@ -1,10 +1,17 @@
 FROM nginx:alpine
 FROM nginx:alpine
+
 COPY ./dist /var/www
 COPY ./dist /var/www
 COPY default.nginx.conf /etc/nginx/conf.d/
 COPY default.nginx.conf /etc/nginx/conf.d/
 COPY nginx.conf /etc/nginx/
 COPY nginx.conf /etc/nginx/
+COPY ./docker-entrypoint.sh /usr/local/bin/
+
+RUN adduser 1001 -g 1000 -D
+RUN chown 1001:1000 -R /var/www
+RUN chown 1001:1000 -R /etc/nginx
 
 
 ENV BASE_URL=/model
 ENV BASE_URL=/model
 
 
-COPY ./docker-entrypoint.sh /usr/local/bin/
+USER 1001
+
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["nginx", "-g", "daemon off;"]
 CMD ["nginx", "-g", "daemon off;"]