Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(docker): Run as non-root user in docker #1914

Conversation

frsann
Copy link
Contributor

@frsann frsann commented Oct 5, 2020

This PR fixes the issue of the services being run as root, which is suboptimal as the code executed in the container can get root access on the host machine. We add a datahub user and group in the Docker images, and the services are run using that user.

Checklist

  • The PR conforms to DataHub's Contributing Guideline (particularly Commit Message Format)
  • Links to related issues (if applicable)
  • Tests for the changes have been added/updated (if applicable)
  • Docs related to the changes have been added/updated (if applicable)

@frsann
Copy link
Contributor Author

frsann commented Oct 5, 2020

The frontend creates a pid file, and the user needs write access to do it. Let me know if you think this should be handled in some other way.

Did a quick smoke test locally and it seems to work, but let me know if some further testing is needed. 🙏

@mars-lan
Copy link
Contributor

mars-lan commented Oct 5, 2020

Thanks for the contribution! This LGTM at a glance. Will have @keremsahin1 & @jplaisted give the final approval.

@jacopoch
Copy link

jacopoch commented Oct 5, 2020

LGTM ✨

@jplaisted
Copy link
Contributor

LGTM, assuming images still start and logs are readable.

@frsann
Copy link
Contributor Author

frsann commented Oct 6, 2020

Yes, they start and logs from all services show up.

@mars-lan mars-lan merged commit 125ae28 into datahub-project:master Oct 6, 2020
@nagarjunakanamarlapudi nagarjunakanamarlapudi added the hacktoberfest-accepted Acceptance for hacktoberfest https://hacktoberfest.com/participation/ label Oct 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
hacktoberfest-accepted Acceptance for hacktoberfest https://hacktoberfest.com/participation/
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants