Skip to content

Commit daa7917

Browse files
Kurt-von-LavenKurt-von-Laven
committed
Run Docker container as user 1000 (#1975)
Previously, mega-linter-runner ran the MegaLinter Docker image as root. In the Docker image, chown the /megalinter, /megalinter-descriptors, and /action/lib/.automation directories to be owned by user and group 1000. Users whose files became owned by root as a consequence of having run a previous version of MegaLinter will need to chown them to be owned by user 1000 when upgrading MegaLinter.
1 parent 4363d26 commit daa7917

File tree

133 files changed

+427
-407
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+427
-407
lines changed

‎.automation/build.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,9 @@ def generate_flavor(flavor, flavor_info):
251251
file.write(action_yml)
252252
logging.info(f"Updated {flavor_action_yml}")
253253
extra_lines = [
254-
"COPY entrypoint.sh /entrypoint.sh",
254+
"COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh",
255255
"RUN chmod +x entrypoint.sh",
256+
"USER 1000",
256257
'ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]',
257258
]
258259
build_dockerfile(

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
2222
- Upgrade create-pull-request and create-or-update-comment GitHub Actions
2323
- Increase auto-update-linters GitHub Action timeout
2424
- Upgrade base Docker image to python:3.11.3-alpine3.17
25+
- Make Docker image rootless, and run it as user 1000 rather than root by
26+
@Kurt-von-Laven in [#1975](https://github.com/oxsecurity/megalinter/issues/1975).
2527

2628
- Documentation
2729

‎Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -668,7 +668,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
668668
################################
669669
# Installs python dependencies #
670670
################################
671-
COPY megalinter /megalinter
671+
COPY --chown=1000:1000 megalinter /megalinter
672672
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
673673
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
674674
&& rm -rf /var/cache/apk/* \
@@ -677,8 +677,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
677677
#######################################
678678
# Copy scripts and rules to container #
679679
#######################################
680-
COPY megalinter/descriptors /megalinter-descriptors
681-
COPY TEMPLATES /action/lib/.automation
680+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
681+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
682682

683683
###########################
684684
# Get the build arguments #
@@ -717,7 +717,8 @@ LABEL com.github.actions.name="MegaLinter" \
717717
org.opencontainers.image.description="Lint your code base with GitHub Actions"
718718

719719
#EXTRA_DOCKERFILE_LINES__START
720-
COPY entrypoint.sh /entrypoint.sh
720+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
721721
RUN chmod +x entrypoint.sh
722+
USER 1000
722723
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
723724
#EXTRA_DOCKERFILE_LINES__END

‎flavors/ci_light/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ RUN wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/m
209209
################################
210210
# Installs python dependencies #
211211
################################
212-
COPY megalinter /megalinter
212+
COPY --chown=1000:1000 megalinter /megalinter
213213
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
214214
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
215215
&& rm -rf /var/cache/apk/* \
@@ -218,8 +218,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
218218
#######################################
219219
# Copy scripts and rules to container #
220220
#######################################
221-
COPY megalinter/descriptors /megalinter-descriptors
222-
COPY TEMPLATES /action/lib/.automation
221+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
222+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
223223

224224
###########################
225225
# Get the build arguments #
@@ -258,7 +258,8 @@ LABEL com.github.actions.name="MegaLinter" \
258258
org.opencontainers.image.description="Lint your code base with GitHub Actions"
259259

260260
#EXTRA_DOCKERFILE_LINES__START
261-
COPY entrypoint.sh /entrypoint.sh
261+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
262262
RUN chmod +x entrypoint.sh
263+
USER 1000
263264
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
264265
#EXTRA_DOCKERFILE_LINES__END

‎flavors/cupcake/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
450450
################################
451451
# Installs python dependencies #
452452
################################
453-
COPY megalinter /megalinter
453+
COPY --chown=1000:1000 megalinter /megalinter
454454
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
455455
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
456456
&& rm -rf /var/cache/apk/* \
@@ -459,8 +459,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
459459
#######################################
460460
# Copy scripts and rules to container #
461461
#######################################
462-
COPY megalinter/descriptors /megalinter-descriptors
463-
COPY TEMPLATES /action/lib/.automation
462+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
463+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
464464

465465
###########################
466466
# Get the build arguments #
@@ -499,7 +499,8 @@ LABEL com.github.actions.name="MegaLinter" \
499499
org.opencontainers.image.description="Lint your code base with GitHub Actions"
500500

501501
#EXTRA_DOCKERFILE_LINES__START
502-
COPY entrypoint.sh /entrypoint.sh
502+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
503503
RUN chmod +x entrypoint.sh
504+
USER 1000
504505
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
505506
#EXTRA_DOCKERFILE_LINES__END

‎flavors/documentation/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
296296
################################
297297
# Installs python dependencies #
298298
################################
299-
COPY megalinter /megalinter
299+
COPY --chown=1000:1000 megalinter /megalinter
300300
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
301301
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
302302
&& rm -rf /var/cache/apk/* \
@@ -305,8 +305,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
305305
#######################################
306306
# Copy scripts and rules to container #
307307
#######################################
308-
COPY megalinter/descriptors /megalinter-descriptors
309-
COPY TEMPLATES /action/lib/.automation
308+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
309+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
310310

311311
###########################
312312
# Get the build arguments #
@@ -345,7 +345,8 @@ LABEL com.github.actions.name="MegaLinter" \
345345
org.opencontainers.image.description="Lint your code base with GitHub Actions"
346346

347347
#EXTRA_DOCKERFILE_LINES__START
348-
COPY entrypoint.sh /entrypoint.sh
348+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
349349
RUN chmod +x entrypoint.sh
350+
USER 1000
350351
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
351352
#EXTRA_DOCKERFILE_LINES__END

‎flavors/dotnet/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -391,7 +391,7 @@ RUN curl --retry 5 --retry-delay 5 -sLO "${ARM_TTK_URI}" \
391391
################################
392392
# Installs python dependencies #
393393
################################
394-
COPY megalinter /megalinter
394+
COPY --chown=1000:1000 megalinter /megalinter
395395
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
396396
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
397397
&& rm -rf /var/cache/apk/* \
@@ -400,8 +400,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
400400
#######################################
401401
# Copy scripts and rules to container #
402402
#######################################
403-
COPY megalinter/descriptors /megalinter-descriptors
404-
COPY TEMPLATES /action/lib/.automation
403+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
404+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
405405

406406
###########################
407407
# Get the build arguments #
@@ -440,7 +440,8 @@ LABEL com.github.actions.name="MegaLinter" \
440440
org.opencontainers.image.description="Lint your code base with GitHub Actions"
441441

442442
#EXTRA_DOCKERFILE_LINES__START
443-
COPY entrypoint.sh /entrypoint.sh
443+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
444444
RUN chmod +x entrypoint.sh
445+
USER 1000
445446
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
446447
#EXTRA_DOCKERFILE_LINES__END

‎flavors/go/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
311311
################################
312312
# Installs python dependencies #
313313
################################
314-
COPY megalinter /megalinter
314+
COPY --chown=1000:1000 megalinter /megalinter
315315
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
316316
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
317317
&& rm -rf /var/cache/apk/* \
@@ -320,8 +320,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
320320
#######################################
321321
# Copy scripts and rules to container #
322322
#######################################
323-
COPY megalinter/descriptors /megalinter-descriptors
324-
COPY TEMPLATES /action/lib/.automation
323+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
324+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
325325

326326
###########################
327327
# Get the build arguments #
@@ -360,7 +360,8 @@ LABEL com.github.actions.name="MegaLinter" \
360360
org.opencontainers.image.description="Lint your code base with GitHub Actions"
361361

362362
#EXTRA_DOCKERFILE_LINES__START
363-
COPY entrypoint.sh /entrypoint.sh
363+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
364364
RUN chmod +x entrypoint.sh
365+
USER 1000
365366
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
366367
#EXTRA_DOCKERFILE_LINES__END

‎flavors/java/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,7 @@ RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${P
324324
################################
325325
# Installs python dependencies #
326326
################################
327-
COPY megalinter /megalinter
327+
COPY --chown=1000:1000 megalinter /megalinter
328328
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
329329
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
330330
&& rm -rf /var/cache/apk/* \
@@ -333,8 +333,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
333333
#######################################
334334
# Copy scripts and rules to container #
335335
#######################################
336-
COPY megalinter/descriptors /megalinter-descriptors
337-
COPY TEMPLATES /action/lib/.automation
336+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
337+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
338338

339339
###########################
340340
# Get the build arguments #
@@ -373,7 +373,8 @@ LABEL com.github.actions.name="MegaLinter" \
373373
org.opencontainers.image.description="Lint your code base with GitHub Actions"
374374

375375
#EXTRA_DOCKERFILE_LINES__START
376-
COPY entrypoint.sh /entrypoint.sh
376+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
377377
RUN chmod +x entrypoint.sh
378+
USER 1000
378379
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
379380
#EXTRA_DOCKERFILE_LINES__END

‎flavors/javascript/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
312312
################################
313313
# Installs python dependencies #
314314
################################
315-
COPY megalinter /megalinter
315+
COPY --chown=1000:1000 megalinter /megalinter
316316
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
317317
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
318318
&& rm -rf /var/cache/apk/* \
@@ -321,8 +321,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
321321
#######################################
322322
# Copy scripts and rules to container #
323323
#######################################
324-
COPY megalinter/descriptors /megalinter-descriptors
325-
COPY TEMPLATES /action/lib/.automation
324+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
325+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
326326

327327
###########################
328328
# Get the build arguments #
@@ -361,7 +361,8 @@ LABEL com.github.actions.name="MegaLinter" \
361361
org.opencontainers.image.description="Lint your code base with GitHub Actions"
362362

363363
#EXTRA_DOCKERFILE_LINES__START
364-
COPY entrypoint.sh /entrypoint.sh
364+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
365365
RUN chmod +x entrypoint.sh
366+
USER 1000
366367
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
367368
#EXTRA_DOCKERFILE_LINES__END

‎flavors/php/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@ RUN composer global require --ignore-platform-reqs overtrue/phplint ^5.3 \
340340
################################
341341
# Installs python dependencies #
342342
################################
343-
COPY megalinter /megalinter
343+
COPY --chown=1000:1000 megalinter /megalinter
344344
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
345345
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
346346
&& rm -rf /var/cache/apk/* \
@@ -349,8 +349,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
349349
#######################################
350350
# Copy scripts and rules to container #
351351
#######################################
352-
COPY megalinter/descriptors /megalinter-descriptors
353-
COPY TEMPLATES /action/lib/.automation
352+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
353+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
354354

355355
###########################
356356
# Get the build arguments #
@@ -389,7 +389,8 @@ LABEL com.github.actions.name="MegaLinter" \
389389
org.opencontainers.image.description="Lint your code base with GitHub Actions"
390390

391391
#EXTRA_DOCKERFILE_LINES__START
392-
COPY entrypoint.sh /entrypoint.sh
392+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
393393
RUN chmod +x entrypoint.sh
394+
USER 1000
394395
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
395396
#EXTRA_DOCKERFILE_LINES__END

‎flavors/python/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
307307
################################
308308
# Installs python dependencies #
309309
################################
310-
COPY megalinter /megalinter
310+
COPY --chown=1000:1000 megalinter /megalinter
311311
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
312312
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
313313
&& rm -rf /var/cache/apk/* \
@@ -316,8 +316,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
316316
#######################################
317317
# Copy scripts and rules to container #
318318
#######################################
319-
COPY megalinter/descriptors /megalinter-descriptors
320-
COPY TEMPLATES /action/lib/.automation
319+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
320+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
321321

322322
###########################
323323
# Get the build arguments #
@@ -356,7 +356,8 @@ LABEL com.github.actions.name="MegaLinter" \
356356
org.opencontainers.image.description="Lint your code base with GitHub Actions"
357357

358358
#EXTRA_DOCKERFILE_LINES__START
359-
COPY entrypoint.sh /entrypoint.sh
359+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
360360
RUN chmod +x entrypoint.sh
361+
USER 1000
361362
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
362363
#EXTRA_DOCKERFILE_LINES__END

‎flavors/ruby/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
297297
################################
298298
# Installs python dependencies #
299299
################################
300-
COPY megalinter /megalinter
300+
COPY --chown=1000:1000 megalinter /megalinter
301301
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
302302
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
303303
&& rm -rf /var/cache/apk/* \
@@ -306,8 +306,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
306306
#######################################
307307
# Copy scripts and rules to container #
308308
#######################################
309-
COPY megalinter/descriptors /megalinter-descriptors
310-
COPY TEMPLATES /action/lib/.automation
309+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
310+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
311311

312312
###########################
313313
# Get the build arguments #
@@ -346,7 +346,8 @@ LABEL com.github.actions.name="MegaLinter" \
346346
org.opencontainers.image.description="Lint your code base with GitHub Actions"
347347

348348
#EXTRA_DOCKERFILE_LINES__START
349-
COPY entrypoint.sh /entrypoint.sh
349+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
350350
RUN chmod +x entrypoint.sh
351+
USER 1000
351352
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
352353
#EXTRA_DOCKERFILE_LINES__END

‎flavors/rust/Dockerfile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
291291
################################
292292
# Installs python dependencies #
293293
################################
294-
COPY megalinter /megalinter
294+
COPY --chown=1000:1000 megalinter /megalinter
295295
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
296296
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
297297
&& rm -rf /var/cache/apk/* \
@@ -300,8 +300,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
300300
#######################################
301301
# Copy scripts and rules to container #
302302
#######################################
303-
COPY megalinter/descriptors /megalinter-descriptors
304-
COPY TEMPLATES /action/lib/.automation
303+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
304+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
305305

306306
###########################
307307
# Get the build arguments #
@@ -340,7 +340,8 @@ LABEL com.github.actions.name="MegaLinter" \
340340
org.opencontainers.image.description="Lint your code base with GitHub Actions"
341341

342342
#EXTRA_DOCKERFILE_LINES__START
343-
COPY entrypoint.sh /entrypoint.sh
343+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
344344
RUN chmod +x entrypoint.sh
345+
USER 1000
345346
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
346347
#EXTRA_DOCKERFILE_LINES__END

0 commit comments

Comments
 (0)