Running protoc-gen-kotlin as root fails with an error

[garyp]

Running protoc as root with the --kotlin_out option produces an error:

--kotlin_out: protoc-gen-kotlin: Plugin output is unparseable: \033[0;33mApplication
is running as root (UID 0). This is considered
insecure.\033[0m\nz\344w\n\031pbandk/google/api/http.ktz

This is because pbandk uses Spring Boot's launchScript feature in order to turn protoc-gen-kotlin.jar into a self-executable file. The default launch script used by Spring Boot prints a warning if run as root. This is mainly in place to prevent running Spring Boot jars as services under the root account. Since pbandk doesn't need the service-related functionality, we should probably replace the default Spring Boot launch script with a much-simplified custom version using something like:

tasks.getByName<BootJar>("bootJar") {
    launchScript {
        script = file("src/custom.script")
    }
}

[strophy]

Hi, I'm trying to add the protoc-gen-kotlin plugin to https://github.com/rvolosatovs/docker-protobuf (maybe this would resolve #224 for you?) and I'm running into this problem with the warning from Spring Boot about running as root. I'm trying to determine if it would be easier to make this change away from Spring Boot in pbandk, or if we should figure out how to adjust the container running the file to use an unprivileged user. Thoughts?

[garyp]

In general, using an unprivileged user is best practice for Docker containers. But I don't know if that would make the docker-protobuf container more difficult to use since it's main purpose is to read/write files outside of the container and doing that with non-root permissions could be more challenging.

I don't think the change on the pbandk side to make this work properly would be that difficult if you wanted to tackle it on the pbandk side. It involves:

1. Updating the launchScript definition at https://github.com/streem/pbandk/blob/master/protoc-gen-pbandk/jvm/build.gradle.kts#L29 to use a custom script path (see my example above).
2. Creating the custom script. I believe this is the script used by default: https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/main/resources/org/springframework/boot/loader/tools/launch.script. You could start simple and just remove the root user warning from that script. Or if you're feeling more ambitious, you could strip out the majority of what's in that script since we don't need any of the service-related init.d and systemd functionality in that script.