fix: go back to using root user in Dockerfile#281
Conversation
We have to do this because we have no active way to change permissions to $GITHUB_OUTPUT to a specific user when running the container Add trivy ignore to top of Dockerfile to pass linting Signed-off-by: jmeridth <jmeridth@gmail.com>
There was a problem hiding this comment.
Pull Request Overview
This PR reverts the Docker container to run as root user instead of a non-root user due to permission issues with writing to $GITHUB_OUTPUT. The change removes the non-root user setup that was previously implemented for security purposes.
- Removes non-root user creation and configuration from Dockerfile
- Adds trivy security scanner ignore directive for running as root user
- Simplifies the container setup by removing user switching logic
| @@ -1,5 +1,6 @@ | |||
| #checkov:skip=CKV_DOCKER_2 | |||
| #checkov:skip=CKV_DOCKER_3 | |||
| #trivy:ignore:AVD-DS-0002 | |||
There was a problem hiding this comment.
Running containers as root user creates security risks. Consider implementing a solution to properly set permissions on $GITHUB_OUTPUT directory instead of reverting to root user. This could involve using initContainers, volume mounts with proper permissions, or GitHub Actions workflow adjustments.
|
|
||
| # Run the action as a non-root user | ||
| USER appuser | ||
| && rm -rf /var/lib/apt/lists/* |
There was a problem hiding this comment.
The PR description mentions permission issues with $GITHUB_OUTPUT, but there's no documentation in the code explaining why root user is required. Consider adding a comment explaining the specific permission constraint that necessitates running as root.
Pull Request
Proposed Changes
We have to do this because we have no active way to change permissions to $GITHUB_OUTPUT to a specific user when running the container
Add trivy ignore to top of Dockerfile to pass linting
Readiness Checklist
Author/Contributor
make lintand fix any issues that you have introducedmake testand ensure you have test coverage for the lines you are introducing@jeffrey-luszczReviewer
fix,documentation,enhancement,infrastructure,maintenanceorbreaking