From a8e75d03f48d0a7d7ae7c18f8151ef2e244a787d Mon Sep 17 00:00:00 2001 From: sousaedu Date: Thu, 30 Sep 2021 14:07:57 +0100 Subject: [PATCH] Fix bug 1703 - Adding non-root user to run NBI The idea behind this is to run NBI as a non-root user for security reasons. This required the creation of a new user in the container image and setting permissions acordingly. Change-Id: I9c8105b9b648c79643940994e51815118b9bbbe7 Signed-off-by: sousaedu --- docker/NBI/Dockerfile | 17 ++++++++++------- installers/docker/osm_pods/nbi.yaml | 11 ++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docker/NBI/Dockerfile b/docker/NBI/Dockerfile index 4ac2a495..2e69264a 100644 --- a/docker/NBI/Dockerfile +++ b/docker/NBI/Dockerfile @@ -54,21 +54,25 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get --yes update && \ COPY --from=INSTALL /usr/lib/python3/dist-packages /usr/lib/python3/dist-packages COPY --from=INSTALL /usr/local/lib/python3.6/dist-packages /usr/local/lib/python3.6/dist-packages -RUN mkdir -p /app/storage/kafka && mkdir -p /app/log +# Creating the user for the app +RUN groupadd -g 1000 appuser && \ + useradd -u 1000 -g 1000 -d /app appuser && \ + mkdir -p /app/osm_nbi && \ + mkdir -p /app/storage/kafka && \ + mkdir /app/log && \ + chown -R appuser:appuser /app WORKDIR /app/osm_nbi +# Changing the security context +USER appuser + EXPOSE 9999 RUN cp -R /usr/lib/python3/dist-packages/osm_nbi/html_public /app/osm_nbi/html_public RUN cp /usr/lib/python3/dist-packages/osm_nbi/nbi.cfg /app/osm_nbi/ RUN cp -R /usr/lib/python3/dist-packages/osm_nbi/http /app/osm_nbi/ -# Used for local storage -VOLUME /app/storage -# Used for logs -VOLUME /app/log - # The following ENV can be added with "docker run -e xxx' to configure # server ENV OSMNBI_SOCKET_HOST 0.0.0.0 @@ -111,4 +115,3 @@ HEALTHCHECK --start-period=120s --interval=10s --timeout=5s --retries=5 \ # Run app.py when the container launches CMD python3 -m osm_nbi.nbi - diff --git a/installers/docker/osm_pods/nbi.yaml b/installers/docker/osm_pods/nbi.yaml index 29780828..bbdf6451 100644 --- a/installers/docker/osm_pods/nbi.yaml +++ b/installers/docker/osm_pods/nbi.yaml @@ -44,6 +44,10 @@ spec: labels: app: nbi spec: + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 initContainers: - name: kafka-mongo-test image: alpine:latest @@ -70,10 +74,3 @@ spec: envFrom: - secretRef: name: nbi-secret - volumeMounts: - - name: osm-packages - mountPath: /app/storage - volumes: - - name: osm-packages - hostPath: - path: /var/lib/osm/osm_osm_packages/_data -- 2.25.1