Run containers using Non Privileged user

build/Dockerfile

@@ -29,6 +29,13 @@ RUN apk add --no-cache ca-certificates bash git \
 # Production image
 FROM alpine:3.10
 
+# Create Non Privilaged user
+RUN groupadd -g 101 botkube && \
+ useradd -r -u 101 -g botkube botkube
+
+# Run as Non Privilaged user
+USER botkube
+
 COPY --from=BUILD-ENV /go/bin/botkube /go/bin/botkube
 COPY --from=BUILD-ENV /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=BUILD-ENV /usr/local/bin/kubectl /usr/local/bin/kubectl

deploy-all-in-one-tls.yaml

@@ -319,3 +319,7 @@ spec:
         - name: certs
           secret:
             secretName: botkube-secret
+      # run as non privilaged user
+      securityContext:
+        runAsUser: 101
+        runAsGroup: 101

deploy-all-in-one.yaml

@@ -305,3 +305,7 @@ spec:
         - name: config-volume
           configMap:
             name: botkube-configmap
+      # run as non privilaged user
+      securityContext:
+        runAsUser: 101
+        runAsGroup: 101

helm/botkube/templates/deployment.yaml

@@ -57,3 +57,9 @@ spec:
           secret:
             secretName: {{ include "botkube.fullname" . }}-secret
       {{ end }}
+      {{- if .Values.securityContext }}
+      securityContext:
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
+      {{ end }}
+

helm/botkube/values.yaml

@@ -14,6 +14,12 @@ image:
 nameOverride: ""
 fullnameOverride: ""
 
+# Configure securityContext to manage user Privileges in pods
+# set to run as a Non-Privileged user by default
+securityContext:
+  runAsUser: 101
+  runAsGroup: 101
+
 # set one of the log levels- info, warn, debug, error, fatal, panic
 logLevel: info