Run operator container as non-root (#777)

Co-authored-by: Jacob Tomlinson <jtomlinson@nvidia.com>
dask · Jul 26, 2023 · 1ff7534 · 1ff7534
1 parent 26e137a
commit 1ff7534
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 7 deletions.
diff --git a/dask_kubernetes/operator/deployment/Dockerfile b/dask_kubernetes/operator/deployment/Dockerfile
@@ -10,6 +10,12 @@ WORKDIR /src/dask_kubernetes
 # Install dependencies
 RUN pip install .
 
+# Add non-root user
+RUN useradd -s /bin/bash dask
+
+# Run container as non-root
+USER 1000
+
 # Start operator
 ENTRYPOINT ["/usr/local/bin/kopf", "run", "-m", "dask_kubernetes.operator.controller"]
 CMD ["--liveness=http://0.0.0.0:8080/healthz", "--verbose", "--all-namespaces"]
diff --git a/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/README.md b/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/README.md
@@ -24,7 +24,10 @@ The following table lists the configurable parameters of the Dask-kubernetes-ope
 | `rbac.cluster` | Creates a ClusterRole if true, else create a namespaced Role | `true` |
 | `podAnnotations` | Extra annotations for the operator pod | `{}` |
 | `podSecurityContext` | Security context for the operator pod | `{}` |
-| `securityContext` | Security context for the operator container | `{}` |
+| `securityContext.capabilities.drop` |  | `["ALL"]` |
+| `securityContext.runAsNonRoot` |  | `true` |
+| `securityContext.runAsUser` |  | `1000` |
+| `securityContext.allowPrivilegeEscalation` |  | `false` |
 | `resources` | Resources for the operator pod | `{}` |
 | `volumes` | Volumes for the operator pod | `[]` |
 | `volumeMounts` | Volume mounts for the operator container | `[]` |

diff --git a/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/values.yaml b/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/values.yaml
@@ -21,13 +21,14 @@ podAnnotations: {}  # Extra annotations for the operator pod
 podSecurityContext: {}  # Security context for the operator pod
   # fsGroup: 2000
 
-securityContext: {}  # Security context for the operator container
-  # capabilities:
-  #   drop:
-  #   - ALL
+securityContext:  # Security context for the operator container
+  capabilities:
+    drop:
+    - ALL
+  runAsNonRoot: true
+  runAsUser: 1000
+  allowPrivilegeEscalation: false
   # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
 
 resources: {}  # Resources for the operator pod
   # We usually recommend not to specify default resources and to leave this as a conscious