Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't run docker container as root #201

Closed
der-eismann opened this issue Apr 17, 2019 · 2 comments · Fixed by #202
Closed

Don't run docker container as root #201

der-eismann opened this issue Apr 17, 2019 · 2 comments · Fixed by #202

Comments

@der-eismann
Copy link

IMHO it is accepted as best practice to not run processes in containers as root. It is a problem that is affecting many of prometheus' exporters and I'm not sure if this was discussed before.
It can be fixed pretty easily by adding two lines to the Dockerfile:

RUN adduser -D statsd-exporter
USER statsd-exporter
@SuperQ
Copy link
Member

SuperQ commented Apr 17, 2019

We typically use nobody for our containers.

@der-eismann
Copy link
Author

I've seen this in some containers (prometheus, alertmanager, node-exporter, pushgateway, prom2json) , but I think it isn't everywhere yet:

$ docker run --entrypoint /bin/whoami prom/statsd-exporter
root

It would be great if you could start adapting it in the other containers as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants