Skip to content

Don't run as root in Docker container #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MoeRT09 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Don't run as root in Docker container #140

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
# - at least docker 19.03
# - docker buildkit enabled (export DOCKER_BUILDKIT=1)

FROM eclipse-temurin:17-jdk as builder
FROM eclipse-temurin:17-jdk AS builder

COPY ./ /build

Expand All @@ -15,9 +15,17 @@ WORKDIR /build
RUN ./gradlew :bootJar -x test

FROM eclipse-temurin:17-jre
ARG UID=1005

COPY --from=builder /build/build/libs/unipipe-service-broker-1.0.0.jar /app/
COPY --chown=0:0 --chmod=555 --from=builder /build/build/libs/unipipe-service-broker-1.0.0.jar /app/
Copy link
Member

@JohannesRudolph JohannesRudolph Apr 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can the chown command in the COPY and in the RUN instruction below be combined into the COPY instruction already?

Copy link
Author

@MoeRT09 MoeRT09 Apr 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No not really, the idea was that the jar is owned by root and can only be executed (not modified) by other users. While the /app itself must be writeable for the unprivileged container user, which runs the jar as it writes the SSH key into the /app/tmp directory (and also creates the /app/tmp directory after #139 )


WORKDIR /app

RUN useradd -u $UID -ms /bin/bash unipipe && \
chown $UID /app

USER $UID

EXPOSE 8075

ENTRYPOINT [ "/app/unipipe-service-broker-1.0.0.jar" ]