Skip to content

Commit 5d43e44

Browse files
Shinji-IkariGShinji-IkariG
authored
Switch to non-root container user (#6012)
* Update Dockerfile.graphd * Update Dockerfile.metad * Update Dockerfile.storaged * Update Dockerfile.tools * Update Dockerfile.storaged * Update Dockerfile.metad * Update Dockerfile.graphd * Update Dockerfile * update useradd args
1 parent 1f3c6b2 commit 5d43e44

File tree

5 files changed

+48
-8
lines changed

5 files changed

+48
-8
lines changed

‎docker/Dockerfile‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,57 +10,77 @@ RUN cd /home/nebula/BUILD/package \
1010

1111
FROM centos:7 as graphd
1212

13+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
14+
1315
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
1416
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-graph.rpm /usr/local/nebula/nebula-graphd.rpm
1517

1618
WORKDIR /usr/local/nebula
1719

1820
RUN rpm -ivh *.rpm \
1921
&& mkdir -p ./{logs,data,pids} \
20-
&& rm -rf *.rpm
22+
&& rm -rf *.rpm \
23+
&& chown -R nebula:nebula /usr/local/nebula
2124

2225
EXPOSE 9669 19669 19670
2326

27+
USER nebula
28+
2429
ENTRYPOINT ["/usr/local/nebula/bin/nebula-graphd", "--flagfile=/usr/local/nebula/etc/nebula-graphd.conf", "--daemonize=false", "--containerized=true"]
2530

2631
FROM centos:7 as metad
2732

33+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
34+
2835
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
2936
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-meta.rpm /usr/local/nebula/nebula-metad.rpm
3037

3138
WORKDIR /usr/local/nebula
3239

3340
RUN rpm -ivh *.rpm \
3441
&& mkdir -p ./{logs,data,pids} \
35-
&& rm -rf *.rpm
42+
&& rm -rf *.rpm \
43+
&& chown -R nebula:nebula /usr/local/nebula
3644

3745
EXPOSE 9559 9560 19559 19560
3846

47+
USER nebula
48+
3949
ENTRYPOINT ["/usr/local/nebula/bin/nebula-metad", "--flagfile=/usr/local/nebula/etc/nebula-metad.conf", "--daemonize=false", "--containerized=true"]
4050

4151
FROM centos:7 as storaged
4252

53+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
54+
4355
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
4456
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-storage.rpm /usr/local/nebula/nebula-storaged.rpm
4557

4658
WORKDIR /usr/local/nebula
4759

4860
RUN rpm -ivh *.rpm \
4961
&& mkdir -p ./{logs,data,pids} \
50-
&& rm -rf *.rpm
62+
&& rm -rf *.rpm \
63+
&& chown -R nebula:nebula /usr/local/nebula
5164

5265
EXPOSE 9777 9778 9779 9780 19779 19780
5366

67+
USER nebula
68+
5469
ENTRYPOINT ["/usr/local/nebula/bin/nebula-storaged", "--flagfile=/usr/local/nebula/etc/nebula-storaged.conf", "--daemonize=false", "--containerized=true"]
5570

5671
FROM centos:7 as tools
5772

73+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
74+
5875
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-tool.rpm /usr/local/nebula/nebula-tool.rpm
5976

6077
WORKDIR /usr/local/nebula
6178

6279
RUN rpm -ivh *.rpm \
63-
&& rm -rf *.rpm
80+
&& rm -rf *.rpm \
81+
&& chown -R nebula:nebula /usr/local/nebula
82+
83+
USER nebula
6484

6585
# default entrypoint
6686
ENTRYPOINT ["/usr/local/nebula/bin/db_dump"]

‎docker/Dockerfile.graphd‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,19 @@ RUN cd /home/nebula/BUILD/package \
1010

1111
FROM centos:7
1212

13+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
14+
1315
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
1416
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-graph.rpm /usr/local/nebula/nebula-graphd.rpm
1517

1618
WORKDIR /usr/local/nebula
1719

1820
RUN rpm -ivh *.rpm \
1921
&& mkdir -p ./{logs,data,pids} \
20-
&& rm -rf *.rpm
22+
&& rm -rf *.rpm \
23+
&& chown -R nebula:nebula /usr/local/nebula
24+
25+
USER nebula
2126

2227
EXPOSE 9669 19669 19670
2328

‎docker/Dockerfile.metad‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,19 @@ RUN cd /home/nebula/BUILD/package \
1010

1111
FROM centos:7
1212

13+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
14+
1315
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
1416
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-meta.rpm /usr/local/nebula/nebula-metad.rpm
1517

1618
WORKDIR /usr/local/nebula
1719

1820
RUN rpm -ivh *.rpm \
1921
&& mkdir -p ./{logs,data,pids} \
20-
&& rm -rf *.rpm
22+
&& rm -rf *.rpm \
23+
&& chown -R nebula:nebula /usr/local/nebula
24+
25+
USER nebula
2126

2227
EXPOSE 9559 9560 19559 19560
2328

‎docker/Dockerfile.storaged‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,19 @@ RUN cd /home/nebula/BUILD/package \
1010

1111
FROM centos:7
1212

13+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
14+
1315
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-common.rpm /usr/local/nebula/nebula-common.rpm
1416
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-storage.rpm /usr/local/nebula/nebula-storaged.rpm
1517

1618
WORKDIR /usr/local/nebula
1719

1820
RUN rpm -ivh *.rpm \
1921
&& mkdir -p ./{logs,data,pids} \
20-
&& rm -rf *.rpm
22+
&& rm -rf *.rpm \
23+
&& chown -R nebula:nebula /usr/local/nebula
24+
25+
USER nebula
2126

2227
EXPOSE 9777 9778 9779 9780 19779 19780
2328

‎docker/Dockerfile.tools‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,17 @@ RUN cd /home/nebula/BUILD/package \
1010

1111
FROM centos:7
1212

13+
RUN groupadd -r nebula && useradd -r -g nebula -d /usr/local/nebula nebula
14+
1315
COPY --from=builder /home/nebula/BUILD/pkg-build/cpack_output/nebula-*-tool.rpm /usr/local/nebula/nebula-tool.rpm
1416

1517
WORKDIR /usr/local/nebula
1618

1719
RUN rpm -ivh *.rpm \
18-
&& rm -rf *.rpm
20+
&& rm -rf *.rpm \
21+
&& chown -R nebula:nebula /usr/local/nebula
22+
23+
USER nebula
1924

2025
# default entrypoint
2126
ENTRYPOINT ["/usr/local/nebula/bin/db_dump"]

0 commit comments

Comments
 (0)