Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use UID for dockerfile to allow runasNonRoot to be used. #35272

Merged
merged 3 commits into from
May 4, 2023
Merged

Use UID for dockerfile to allow runasNonRoot to be used. #35272

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9715bbb
Use UID for dockerfile to allow runasNonRoot to be used.
naemono May 1, 2023
0b55db7
Merge branch 'main' into 6740-dockerfile-use-uid-not-name
naemono May 2, 2023
3806a93
Merge branch 'main' into 6740-dockerfile-use-uid-not-name
naemono May 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion dev-tools/packaging/templates/docker/Dockerfile.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,8 +168,10 @@ RUN for iter in {1..10}; do \
done; \
(exit $exit_code)
{{- end }}
USER 1000
{{- else }}
USER 0
Copy link
Member

@cmacknz cmacknz May 3, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without us having a test to ensure runAsNonRoot keeps working there is a chance someone accidentally breaks this in the future.

Are there tests for this not breaking in ECK that we can rely on? Or should be adding a regression test in Beats to make sure this keeps working?

We have a k8s test pipeline stage that could conceivably include this check eventually:

beats/Jenkinsfile

Lines 321 to 332 in 3806a93

def k8sTest(Map args = [:]) {
def versions = args.versions
versions.each{ v ->
withNode(labels: args.label, forceWorkspace: true){
stage("${args.context} ${v}"){
withEnv(["K8S_VERSION=${v}"]){
withGithubNotify(context: "${args.context} ${v}") {
withBeatsEnv(archive: false, withModule: false) {
withTools(k8s: true) {
sh(label: "Integration tests", script: "MODULE=kubernetes make -C metricbeat integration-tests")
sh(label: "Deploy to kubernetes",script: "make -C deploy/kubernetes test")
}

Right now it just makes sure the default k8s YAML deploys successfully.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can get a test in place shortly and I'll link the PR here

Copy link
Contributor Author

@naemono naemono May 3, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually @cmacknz I can't get a test in place for this working until this feature is merged, and I know in what version of Beats this is functional.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it, thanks

{{- end }}
USER {{ .user }}

{{- range $i, $port := .ExposePorts }}
EXPOSE {{ $port }}
Expand Down