Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASH Running as non-root user #109

Open
wants to merge 37 commits into
base: main
Choose a base branch
from

Conversation

rafaelpereyra
Copy link
Contributor

@rafaelpereyra rafaelpereyra commented Oct 28, 2024

Issue #, if available:
N/A
Description of changes:
Rebase from main with changes in #79 .

In this PR we made the following changes:

  • Run ash as non-root user to comply with the security scans (ASH on ASH) and best practices.
  • Create a CI version of the docker file that still runs as root to comply with the different requirements from building platforms where UID/GID cannot be modified and there are additional agents installed at runtime that requires elevated privileges.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

climbertjh2 and others added 25 commits April 29, 2024 12:36
…rtjh2/automated-security-helper into feature/78/run-container-non-root
Copy link
Contributor

@climbertjh2 climbertjh2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting one minor change.

Dockerfile Outdated Show resolved Hide resolved
climbertjh2
climbertjh2 previously approved these changes Oct 28, 2024
Copy link
Contributor

@climbertjh2 climbertjh2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good to me.

Copy link
Contributor Author

@rafaelpereyra rafaelpereyra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check 777 permission on /src and /out folders

Dockerfile Outdated Show resolved Hide resolved
@climbertjh2
Copy link
Contributor

This is better than where we started - so I'm good with merging.

scrthq
scrthq previously approved these changes Nov 1, 2024
@rafaelpereyra
Copy link
Contributor Author

Includes changes from #79

@rafaelpereyra rafaelpereyra changed the title Merge from main ASH Running as non-root user Nov 1, 2024
scrthq
scrthq previously approved these changes Nov 1, 2024
Copy link
Contributor

@awsmadi awsmadi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks great!

Copy link
Contributor

@climbertjh2 climbertjh2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good to me.

I understand the addition of --target to the command-line options, since it is similar to the docker build command-line option of --target. However, in the context of the ash command-line, I think it might cause some confusion.

Also, in the command-line help, it says image to build - it probably should say image to run/build.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants