Kaynağa Gözat

Resolve opencost-ui container running as root (#2135)

CIS Kubernetes v1.23 advises in 5.2.7 to not run containers as root where not needed. Namespaces in K8S distros like RKE2 by default deny the ability to run as root. 

This fixes the container so it'll run as a non-root user by default.

Signed-off-by: David Jericho <davidj@diskpig.org>
Co-authored-by: David Jericho <davidj@diskpig.org>
Cliff Colvin 3 yıl önce
ebeveyn
işleme
d30928b4ea
1 değiştirilmiş dosya ile 8 ekleme ve 1 silme
  1. 8 1
      ui/Dockerfile.cross

+ 8 - 1
ui/Dockerfile.cross

@@ -1,10 +1,17 @@
 FROM nginx:alpine
 FROM nginx:alpine
+
 COPY ./dist /var/www
 COPY ./dist /var/www
 COPY default.nginx.conf /etc/nginx/conf.d/
 COPY default.nginx.conf /etc/nginx/conf.d/
 COPY nginx.conf /etc/nginx/
 COPY nginx.conf /etc/nginx/
+COPY ./docker-entrypoint.sh /usr/local/bin/
+
+RUN adduser 1001 -g 1000 -D
+RUN chown 1001:1000 -R /var/www
+RUN chown 1001:1000 -R /etc/nginx
 
 
 ENV BASE_URL=/model
 ENV BASE_URL=/model
 
 
-COPY ./docker-entrypoint.sh /usr/local/bin/
+USER 1001
+
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["nginx", "-g", "daemon off;"]
 CMD ["nginx", "-g", "daemon off;"]