Merge pull request #26 from barcostreams/run-as-non-root

Run as non-root and set security context

.dockerignore

@@ -0,0 +1,2 @@
+/docs
+/build

build/container/Dockerfile

@@ -22,4 +22,13 @@ LABEL org.opencontainers.image.description="Lightweight, elastic, kubernetes-nat
 
 WORKDIR /work/
 COPY --from=builder /build/barco .
+
+RUN mkdir /var/lib/barco
+
+RUN chgrp -R 0 /var/lib/barco && \
+    chmod -R g=u /var/lib/barco && \
+    chown -R 1001:0 /var/lib/barco
+
+USER 1001
+
 CMD ["/work/barco"]

deploy/kubernetes/barco.yaml

@@ -101,6 +101,14 @@ spec:
       - name: barco
         image: barcostreams/barco:dev1
         imagePullPolicy: Always
+        securityContext:
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            drop:
+              - ALL
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
         ports:
         - containerPort: 9250
           name: discovery