Docker container runs as root by default which is insecure

[gerethd]

Execing into the container shows that the container by default runs as root user which is very insecure. Dockerfile should be changed to use a non root user.

[F43nd1r]

I'd dispute that it is "very insecure". It is a docker container, which in itself is encapsulation regardless of user. (this is the default for spring boot applications btw, the official gradle plugin produces similar docker files). I'll accept PRs for security hardening though.

[gerethd]

By itself technically no but if someone were to manage to break out of the docker container using some other hack as the 'run as' user that would give them access to the host machine as root.

I'm not familiar with the format or the build process you are using is there documentation as to how this works

The build process works fine, although i'm assuming some config is require to make the firefox UI tests work but i'm not really concerned about that, although one the docker image is built I'm not sure what to set JAVA_OPTS to.

[F43nd1r]

Build process is simply a dockerfile https://github.com/F43nd1r/Acrarium/blob/master/acrarium/Dockerfile

[F43nd1r]

that would give them access to the host machine as root.

Careful, this depends on the user running docker on the host, not the user within the container.

[gerethd]

#297

[BeWut]

that would give them access to the host machine as root.

Careful, this depends on the user running docker on the host, not the user within the container.

Since at least some instances will run on Kubernetes this can be a security issue (albeit quite easy to fix), for more information take a look at this: https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#8-run-containers-as-a-non-root-user

And user namespaces are still not supported by Kubernetes as of today. (kubernetes/enhancements#127)