docker: Default to non-root uid/gid in images

[anderseknert]

OPA users have a couple of options to choose from when it comes to Docker images. For any given release, we'll have these image versions published:

openpolicyagent/opa:<version>
openpolicyagent/opa:<version>-debug
openpolicyagent/opa:<version>-rootless
openpolicyagent/opa:<version>-static
openpolicyagent/opa:<version>-envoy
openpolicyagent/opa:<version>-envoy-rootless

For various historic reasons, we've defaulted to uid/gid 0 (i.e. root) in the "default" image, providing a -rootless version for those that wanted to opt out of that. Some time later the -static version appeared to be able to run from base images without glibc such as Alpine. This wasn't made -rootless though. Rather than adding a -static-rootless as well, we should switch the default image run OPA as rootless by default, and allow users that need to run as root for some reason (like having to bind to port 443 without a service in front) to rather opt in to that. This should allow us to reduce the number of image variants, and provide better defaults.

openpolicyagent/opa:<version>
openpolicyagent/opa:<version>-debug
openpolicyagent/opa:<version>-static
openpolicyagent/opa:<version>-envoy

Users who still want or need to run OPA as the root user inside of the container, can easily do so via the docker run --user flag, or by setting the runAsUser, and other approriate attributes on the securityContext in a Kubernetes pod.

Suggested changes:

1. Print warning in logs when OPA is run as root user/group, and information about coming change of defaults.
2. 3-6 releases later, switch default to rootless.
3. Stop publishing -rootless images.

Since we're going slowly with this change, I hope it will give members of the OPA community time to make their voices heard if there is something more we need to consider before making this change.

It should be noted that with the exception of the -debug image, OPA does not provide a shell, or other commands, in its images. The change suggested here is to align with best practices, not to prevent any known issue or attack vector.

[anderseknert]

Alright, so starting from next release (v0.39.0):

• The -rootless image now uses gid 1000 (same as uid)
• Warning is printed when running OPA with uid/gid, including a notice where we recommend -rootless (if docker context) and stating that this will be made the default in future releases.

[ashutosh-narkar]

@anderseknert the changes needed for this are already in afaict. Can we close this ?

[anderseknert]

Not really. Rootless mode is not the default for the standard image. This ticket can be closed when:

• The standard OPA images have switched to uid/gid which is not 0.
• The -rootless images have been decomissioned.

What's been done so far is preparing for that by printing a warning from the next release and forward, plus made the -rootless image run with gid=1000 so that it won't print the same warning. As mentioned in the description, the plan is to move forward with that 3-6 releases from the next one. Until then, there's not a lot to do here.

[srenatus]

Can we also update this quickstart to not need the image with privileges? 👉 https://github.com/open-policy-agent/opa-envoy-plugin/blob/8be224a995562e01c446f402285bbaabdbc68dc0/examples/istio/quick_start.yaml#L279

[anderseknert]

Indeed. We should additionally bind to port 8443 (or whatever) in the OPA container manifest, and have the Service do the 443->8443 port mapping.

[ashutosh-narkar]

In #5718, the standard OPA images have switched to uid/gid which is not 0. A note is added to the -rootless images that they will not be published post 0.50.0

[charlieegan3]

I think that once we have merged #6086, we can close this as the following items will then have been done:

The standard OPA images have switched to uid/gid which is not 0.

We are using non-root base images (and use the same user:group settings for clarity in #6086) also see #5540 #5787 #5718

The -rootless images have been decommissioned.

#6086 completes this.

I'm not really sure what if anything is still needed in opa-envoy #4295 (comment) but think we can move to an issue on that repo if still relevant?

[charlieegan3]

Following some discussion, I have now implemented this: #6091 feedback welcome.