fix: do not run telegraf as root

influxdata · Oct 19, 2021 · 4ca4baf · 4ca4baf
2 parents 5400bab + 314576c
commit 4ca4baf
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 3 deletions.
diff --git a/telegraf/1.18/Dockerfile b/telegraf/1.18/Dockerfile
@@ -30,6 +30,8 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]
diff --git a/telegraf/1.18/alpine/Dockerfile b/telegraf/1.18/alpine/Dockerfile
@@ -25,10 +25,15 @@ RUN set -ex && \
     cp -a /usr/src/telegraf*/usr/bin/telegraf /usr/bin/ && \
     gpgconf --kill all && \
     rm -rf *.tar.gz* /usr/src /root/.gnupg && \
-    apk del .build-deps
+    apk del .build-deps && \
+    addgroup -S telegraf && \
+    adduser -S telegraf -G telegraf && \
+    chown -R telegraf:telegraf /etc/telegraf
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]
diff --git a/telegraf/1.19/Dockerfile b/telegraf/1.19/Dockerfile
@@ -30,6 +30,8 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]
diff --git a/telegraf/1.19/alpine/Dockerfile b/telegraf/1.19/alpine/Dockerfile
@@ -25,10 +25,15 @@ RUN set -ex && \
     cp -a /usr/src/telegraf*/usr/bin/telegraf /usr/bin/ && \
     gpgconf --kill all && \
     rm -rf *.tar.gz* /usr/src /root/.gnupg && \
-    apk del .build-deps
+    apk del .build-deps && \
+    addgroup -S telegraf && \
+    adduser -S telegraf -G telegraf && \
+    chown -R telegraf:telegraf /etc/telegraf
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]
diff --git a/telegraf/1.20/Dockerfile b/telegraf/1.20/Dockerfile
@@ -30,6 +30,8 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]
diff --git a/telegraf/1.20/alpine/Dockerfile b/telegraf/1.20/alpine/Dockerfile
@@ -25,10 +25,15 @@ RUN set -ex && \
     cp -a /usr/src/telegraf*/usr/bin/telegraf /usr/bin/ && \
     gpgconf --kill all && \
     rm -rf *.tar.gz* /usr/src /root/.gnupg && \
-    apk del .build-deps
+    apk del .build-deps && \
+    addgroup -S telegraf && \
+    adduser -S telegraf -G telegraf && \
+    chown -R telegraf:telegraf /etc/telegraf
 
 EXPOSE 8125/udp 8092/udp 8094
 
+USER telegraf
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["telegraf"]