From 7819b6effa4d8d24f9c8da44df582d9bb5215769 Mon Sep 17 00:00:00 2001 From: beierlm Date: Tue, 15 Feb 2022 11:33:36 -0500 Subject: [PATCH] Fix 1705 - Adding non-root user to run RO Change-Id: I5166c695304f7caa0f1781105eab143bf37d071b Signed-off-by: beierlm --- docker/RO/Dockerfile | 16 +++++++++++++--- installers/docker/osm_pods/ro.yaml | 1 - 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/docker/RO/Dockerfile b/docker/RO/Dockerfile index cf6d7146..055c6159 100644 --- a/docker/RO/Dockerfile +++ b/docker/RO/Dockerfile @@ -96,10 +96,21 @@ COPY --from=INSTALL /usr/local/lib/python3.8/dist-packages /usr/local/lib/pytho COPY --from=INSTALL /usr/bin/genisoimage /usr/bin/genisoimage COPY --from=INSTALL /etc/protocols /etc/protocols -VOLUME /var/log/osm - EXPOSE 9090 +# Creating the user for the app +RUN groupadd -g 1000 appuser && \ + useradd -u 1000 -g 1000 -d /app appuser && \ + mkdir -p /app/osm_ro && \ + mkdir -p /app/storage/kafka && \ + mkdir /app/log && \ + chown -R appuser:appuser /app + +WORKDIR /app/osm_ro + +# Changing the security context +USER appuser + # Two mysql databases are needed (DB and DB_OVIM). Can be hosted on same or separated containers # These ENV must be provided ENV RO_DB_HOST="" @@ -141,4 +152,3 @@ HEALTHCHECK --start-period=130s --interval=10s --timeout=5s --retries=12 \ CMD curl --silent --fail http://localhost:9090/ro || exit 1 CMD ["python3", "-u", "-m", "osm_ng_ro.ro_main"] - diff --git a/installers/docker/osm_pods/ro.yaml b/installers/docker/osm_pods/ro.yaml index f484a073..ace84722 100644 --- a/installers/docker/osm_pods/ro.yaml +++ b/installers/docker/osm_pods/ro.yaml @@ -62,4 +62,3 @@ spec: envFrom: - secretRef: name: ro-secret - -- 2.25.1