control-service: run data job as non-root user #710
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
doks5
approved these changes
Feb 16, 2022
mivanov1988
reviewed
Feb 16, 2022
projects/control-service/projects/job-builder-rootless/Dockerfile.python.vdk
Show resolved
Hide resolved
mivanov1988
approved these changes
Feb 16, 2022
Currently data job docker container is run as root user . This is not considered best practice (https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user) And in environment where root is forbidden it won't work. For example the job would fail if data job kubernetes pod is set to run as specific user e.g using: ``` securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 ``` We are making sure that when building the data job we are setting up permissions and users and starting the docker container with new user. The UID and GID can be passed as argument during docker build but that is not currently exposed to operators when deploying jobs. So the UID/GID is currently required to be 1000 Testing Done: deployed locally job with runAsUser securityContext (as above) and the job succeeded. The integration test would verify end to end as well. Signed-off-by: Antoni Ivanov <[email protected]>
antoniivanov
force-pushed
the
person/aivanov/control-service-build
branch
from
b6caaa4 to
6aa4541
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently data job docker container is run as root user . This is not
considered best practice
(https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)
And in environment where root is forbidden it won't work. For example
the job would fail if data job kubernetes pod is set to run as specific
user e.g using:
We are making sure that when building the data job we are setting up
permissions and users and starting the docker container with new user.
The UID and GID can be passed as argument during docker build but that
is not currently exposed to operators when deploying jobs. So the
UID/GID is currently required to be 1000
Testing Done: deployed locally job with runAsUser securityContext (as
above) and the job succeeded. The integration test would verify end to
end as well.
Signed-off-by: Antoni Ivanov [email protected]