RHOAIENG-72: Specify numeric UID in Dockerfiles #348
Conversation
This resolves the ``` Error: container has runAsNonRoot and image has non-numeric user (rhods), cannot verify user is non-root ``` issue. OpenShift (by default) runs images under a random user id and the root user group. See https://access.redhat.com/documentation/cn/openshift_container_platform/4.15/html/images/creating-images#use-uid_create-images
|
/lgtm |
| @@ -57,6 +57,6 @@ COPY --from=builder /workspace/notebook-controller/bin/manager /manager | |||
| COPY --from=builder /workspace/notebook-controller/third_party/license.txt third_party/license.txt | |||
|
|
|||
| ## Switch to a non-root user | |||
| USER rhods | |||
| USER 1001:0 | |||
There was a problem hiding this comment.
What is the reason to include also GID here?
There was a problem hiding this comment.
OpenShift default is to set random uid and 0 gid, https://access.redhat.com/documentation/cn/openshift_container_platform/4.15/html/images/creating-images#use-uid_create-images
I feel like we should keep close to that
There was a problem hiding this comment.
Well, I read this link before, since you have it in the description... so I probably missed something here.
My point is - why setting also GID here as it is 0 by default anyway. From your answer, I understand that it's just a precaution, correct?
|
thanks for your patience waiting for approval! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: atheo89, jstourac The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Thanks! |
|
/retest |
1 similar comment
|
/retest |
35b81f5
into
opendatahub-io:v1.7-branch
|
/cherrypick stable |
|
@harshad16: new pull request created: #356 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
https://issues.redhat.com/browse/RHOAIENG-72
This resolves the
issue.
OpenShift (by default)
runs images under a random user id and the root user group.
See https://access.redhat.com/documentation/cn/openshift_container_platform/4.15/html/images/creating-images#use-uid_create-images
Description
How Has This Been Tested?
Merge criteria: