Skip to content

Run container as codeql user instead of root. #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 6, 2022
Merged

Run container as codeql user instead of root. #42

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b1ea052
Changed the codeql repository permission to be accessible to other us…
cmcdougall Aug 2, 2022
95669bc
Changed the ownership of the codeql repos within the home directory t…
cmcdougall Aug 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,12 @@ LABEL maintainer="Github codeql team"
# tzdata install needs to be non-interactive
ENV DEBIAN_FRONTEND=noninteractive

# install/update basics and python
RUN apt-get update && \
ARG USERNAME=codeql
ENV CODEQL_HOME /usr/local/codeql-home

# create user, install/update basics and python
RUN adduser --home ${CODEQL_HOME} ${USERNAME} && \
apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
software-properties-common \
Expand Down Expand Up @@ -54,10 +58,10 @@ RUN pip3 install --upgrade pip \
&& pip3 install -r /usr/local/startup_scripts/requirements.txt

# Install latest codeQL
ENV CODEQL_HOME /usr/local/codeql-home

# record the latest version of the codeql-cli
RUN python3 /usr/local/startup_scripts/get-latest-codeql-version.py > /tmp/codeql_version
RUN mkdir -p ${CODEQL_HOME} \
RUN mkdir -p \
${CODEQL_HOME}/codeql-repo \
${CODEQL_HOME}/codeql-go-repo \
/opt/codeql
Expand All @@ -80,4 +84,10 @@ RUN codeql query compile --threads=0 ${CODEQL_HOME}/codeql-repo/*/ql/src/codeql-
RUN codeql query compile --threads=0 ${CODEQL_HOME}/codeql-go-repo/ql/src/codeql-suites/*.qls --additional-packs=.

ENV PYTHONIOENCODING=utf-8

# Change ownership of all files and directories within CODEQL_HOME to the codeql user
RUN chown -R ${USERNAME}:${USERNAME} ${CODEQL_HOME}

USER ${USERNAME}

ENTRYPOINT ["python3", "/usr/local/startup_scripts/startup.py"]