Use a numeric USER instruction in Dockerfiles #1082
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
NOTE: This is a replacement for PR #1073 on
master
. As requested, onlyDockerfile.txt
is changed (notDockerfile
). Original PR text folllows:Description
By using a numeric
USER
instruction in Dockerfiles, the images are now able to pass a strict KubernetessecurityContext
configuration. Specifically,runAsNonRoot
, which requires a numeric user/group ID. It is also a Docker best practice. The values of 1200 and 1201 are arbitrary.Motivation and Context
While running a Selenium grid cluster in Kubernetes, I noticed I was unable to run the images with
runAsNonRoot: true
due to the following error:Types of changes
Checklist
Here's an example of the k8s config that runs successfully after this patch:
I can run
VERSION=local make build
locally successfully. Let me know if there's anything I can change or if this can be tested somehow.Thanks,
Steve