Change images to run as non-root user by default

build-all-images.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Set expected JDK versions after the images are built
-declare -A jdkversions=( ["11"]="11.0.15" ["17"]="17.0.3" ["8"]="1.8.0_332" )
+declare -A jdkversions=( ["11"]="11.0.16.1" ["17"]="17.0.4.1" ["8"]="1.8.0_345" )
 
 # Set the base MCR repo
 basemcr="mcr.microsoft.com/openjdk/jdk"

docker/distroless/Dockerfile.msopenjdk-11-jdk

@@ -20,6 +20,16 @@ RUN mkdir -p /usr/lib/jvm && \
 RUN mkdir /staging \
     && tdnf install -y --releasever=2.0 --installroot /staging zlib
 
+# Create non-root user and group javauser
+RUN tdnf install -y  --releasever=2.0 shadow-utils && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    tdnf clean all && \
+   # Copy user/group info to staging
+    cp /etc/passwd /staging/etc/passwd && \
+    cp /etc/group /staging/etc/group
+
 # Clean up staging
 RUN rm -rf /staging/etc/tdnf \
     && rm -rf /staging/run/* \
@@ -37,7 +47,9 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 
 COPY --from=installer /staging/ /
 COPY --from=installer /usr/jdk/ /usr/jdk/
+COPY --from=installer --chown=2000:2000 /app/ /app/
 
+USER javauser
 ENV JAVA_HOME=/usr/jdk
 ENV PATH="$PATH:$JAVA_HOME/bin"
 

docker/distroless/Dockerfile.msopenjdk-17-jdk

@@ -20,6 +20,16 @@ RUN mkdir -p /usr/lib/jvm && \
 RUN mkdir /staging \
     && tdnf install -y --releasever=2.0 --installroot /staging zlib
 
+# Create non-root user and group javauser
+RUN tdnf install -y  --releasever=2.0 shadow-utils && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    tdnf clean all && \
+    # Copy user/group info to staging
+    cp /etc/passwd /staging/etc/passwd && \
+    cp /etc/group /staging/etc/group
+
 # Clean up staging
 RUN rm -rf /staging/etc/tdnf \
     && rm -rf /staging/run/* \
@@ -37,7 +47,9 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 
 COPY --from=installer /staging/ /
 COPY --from=installer /usr/jdk/ /usr/jdk/
+COPY --from=installer --chown=2000:2000 /app/ /app/
 
+USER javauser
 ENV JAVA_HOME=/usr/jdk
 ENV PATH="$PATH:$JAVA_HOME/bin"
 

docker/distroless/Dockerfile.temurin-8-jdk

@@ -16,6 +16,18 @@ RUN mkdir -p /usr/lib/jvm && \
     rm /jdk.tar.gz && \
     mv /jdk8u* /usr/jdk
 
+# Create non-root user and group javauser
+RUN mkdir /staging && \
+    mkdir /staging/etc && \
+    tdnf install -y  --releasever=2.0 shadow-utils && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    tdnf clean all && \
+    mkdir /app && \
+    # Copy user/group info to staging
+    cp /etc/passwd /staging/etc/passwd && \
+    cp /etc/group /staging/etc/group
+
 FROM ${BASE_IMAGE}:${BASE_TAG}
 
 LABEL "Author"="Microsoft"
@@ -24,6 +36,9 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 ENV JAVA_HOME=/usr/jdk
 ENV PATH="$PATH:$JAVA_HOME/bin"
 
+USER javauser
+COPY --from=installer /staging/ /
 COPY --from=installer /usr/jdk/ /usr/jdk/
+COPY --from=installer --chown=2000:2000 /app/ /app/
 
 ENTRYPOINT [ "/usr/jdk/bin/java" ]

docker/mariner-cm1/Dockerfile.msopenjdk-11-jdk

@@ -11,7 +11,11 @@ ARG package=msopenjdk-11
 
 RUN tdnf -y update && \
     tdnf -y upgrade && \
-    tdnf install -y tzdata ca-certificates freetype fontconfig && \
+    tdnf install -y tzdata ca-certificates freetype fontconfig shadow-utils && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/cache/tdnf && \
     rpm -Uvh https://packages.microsoft.com/config/centos/7/packages-microsoft-prod.rpm && \
     tdnf install -y mariner-repos-ui && \
@@ -20,4 +24,5 @@ RUN tdnf -y update && \
     java -Xshare:dump && \
     rm -rf /usr/lib/jvm/msopenjdk-11/lib/src.zip
 
+USER javauser
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-11

docker/mariner-cm1/Dockerfile.msopenjdk-17-jdk

@@ -11,7 +11,11 @@ ARG package=msopenjdk-17
 
 RUN tdnf -y update && \
     tdnf -y upgrade && \
-    tdnf install -y tzdata ca-certificates freetype fontconfig && \
+    tdnf install -y tzdata ca-certificates freetype fontconfig shadow-utils && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/cache/tdnf && \
     rpm -Uvh https://packages.microsoft.com/config/centos/7/packages-microsoft-prod.rpm && \
     tdnf install -y mariner-repos-ui && \
@@ -20,4 +24,5 @@ RUN tdnf -y update && \
     java -Xshare:dump && \
     rm -rf /usr/lib/jvm/msopenjdk-17/lib/src.zip
 
+USER javauser
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-17

docker/mariner/Dockerfile.msopenjdk-11-jdk

@@ -8,13 +8,18 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 ARG package="msopenjdk-11"
-ARG PKGS="tzdata ca-certificates freetype"
+ARG PKGS="tzdata ca-certificates freetype shadow-utils"
 
 RUN tdnf install -y --releasever=2.0 ${package} ${PKGS} && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     tdnf clean all && \
     rm -rf /var/cache/tdnf && \
     echo java -Xshare:dump && \
     java -Xshare:dump && \
     rm -rf /usr/lib/jvm/msopenjdk-11/lib/src.zip
 
+USER javauser
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-11

docker/mariner/Dockerfile.msopenjdk-17-jdk

@@ -8,13 +8,18 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 ARG package="msopenjdk-17"
-ARG PKGS="tzdata ca-certificates freetype"
+ARG PKGS="tzdata ca-certificates freetype shadow-utils"
 
 RUN rpm -Uhv https://packages.microsoft.com/config/centos/7/packages-microsoft-prod.rpm && \
     tdnf install -y ${package} ${PKGS} && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/cache/tdnf && \
     echo java -Xshare:dump && \
     java -Xshare:dump && \
     rm -rf /usr/lib/jvm/msopenjdk-17/lib/src.zip
 
+USER javauser
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-17

docker/mariner/Dockerfile.temurin-8-jdk

@@ -8,11 +8,16 @@ LABEL "Support"="Microsoft OpenJDK Support <openjdk-support@microsoft.com>"
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 ARG JDK_PKG="temurin-8-jdk"
-ARG PKGS="ca-certificates tzdata freetype"
+ARG PKGS="tzdata ca-certificates freetype shadow-utils"
 
 # Install pre-reqs
 RUN tdnf install -y ${JDK_PKG} ${PKGS} && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/cache/tdnf && \
     rm -rf ./usr/lib/jvm/temurin-8-jdk/src.zip
 
+USER javauser
 ENV JAVA_HOME=/usr/lib/jvm/temurin-8-jdk

docker/ubuntu/Dockerfile.msopenjdk-11-jdk

@@ -20,12 +20,15 @@ RUN DEBIAN_FRONTEND=noninteractive && \
     apt-get -qq install $package && \
     apt-get -qq purge apt-transport-https wget && \
     apt-get -qq autoremove --purge && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/lib/apt/lists/* && \
     echo java -Xshare:dump && \
     java -Xshare:dump && \
     rm -rf ./usr/lib/jvm/msopenjdk-11-amd64/lib/src.zip
 
-
+USER javauser
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
-
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-11-amd64

docker/ubuntu/Dockerfile.msopenjdk-17-jdk

@@ -20,11 +20,15 @@ RUN DEBIAN_FRONTEND=noninteractive && \
     apt-get -qq install $package && \
     apt-get -qq purge apt-transport-https wget && \
     apt-get -qq autoremove --purge && \
+    groupadd --system -g 2000 java-app && \
+    useradd -u 2000 -g java-app --shell /bin/false --home-dir /dev/null --system javauser && \
+    mkdir /app && \
+    chown javauser:java-app /app && \
     rm -rf /var/lib/apt/lists/* && \
     echo java -Xshare:dump && \
     java -Xshare:dump && \
     rm -rf ./usr/lib/jvm/msopenjdk-17-amd64/lib/src.zip
 
+USER javauser
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
-
 ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-17-amd64