Refactor Alcove dev container to run rootless#361
Merged
Conversation
Replace root-based process execution with a dedicated alcove user (UID 1001). PostgreSQL initdb and all s6 services now run as non-root, enabling the container to pass OpenShift's runAsNonRoot enforcement without privilege escalation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
s6-overlay needs to create runtime state under /run/s6/ but /run is root-owned. Pre-create and chown to UID 1001 at build time. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
the
awaiting-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refactors
build/Containerfile.devto run entirely as non-root user (UID 1001), making the Alcove dev container compatible with OpenShift'srestricted-v2SCC and KubernetesrunAsNonRoot: truesecurity contexts.Changes
build/Containerfile.dev:alcoveuser/group (UID/GID 1001)postgres) — PostgreSQL only requires PGDATA ownership/var/lib/postgresql,/var/run/postgresql,/workspace,/run/s6) owned by 1001S6_READ_ONLY_ROOT=1— tells s6-overlay to use/runfor state instead of/USER 1001— container runs as non-root by defaultbuild/s6-services/postgres/run:su postgres -cwrapper — postgres runs directly as the container userWhy
The Alcove dev container uses s6-overlay to manage PostgreSQL, NATS, and the shim binary. Previously it ran as root, which fails on OpenShift where
restricted-v2SCC enforcesrunAsNonRoot: true. This matches the same rootless pattern applied to the pulp dev container in pulp/pulp-service#1075.Verified locally
go test ./...passes (no Go code changed)Test plan