Add a non-root image?

[axkng]

Hi,
I initially asked in slack why netbox runs as root in the container.
You can find my message and the related thread here: https://networktocode.slack.com/archives/CD23LP8BC/p1571897479036500

TL;DR:
Netbox runs as root inside the container, which is a security risk. Docker can remap host user-id's to container user-id's, via user namespaces. But Kubernetes (which is most likely used in production) does not support this at the moment.

Because of that @cimnine proposed to start a variant of the netbox-container, like with -ldap.

This issue should be seen as a feature-request for the netbox-container.

Also, @cimnine and me wanted to see if this is interesting for more people, to see if it is worth it.

[kakurpiel]

I had to work around this when deploying to a corporate Kubernetes that would not allow images to run as root. Fortunately it was relatively easy to build an image that ran as non-root, and the only issues I ran in to were file system permissions (as mentioned in slack). The first part of fixing it was changing the owner of the netbox folders in /opt and /etc. The only other adjustment I had to make was where the error log was pointing to in the gunicorn configuration file. Rather than deal with any unintended consequences of changing the ownership of /var/log, I moved this to a different location.

I'd definitely be interested in an official build for this as it would streamline things immensely in more restrictive environments.

[axkng]

Really happy to see that more people want this.

I see @cimnine is also already working on the topic. Thanks a lot for that!

[TheKangaroo]

Same problem here. A simple Dockerfile like

FROM netboxcommunity/netbox:latest

RUN adduser -D -u 1000 netbox \
    && chown -R 1000 /opt/netbox/ \
    && chown -R 1000 /etc/netbox/

USER 1000

did the trick for me.
Of course, you have to add a non-root nginx image and bind it to a low port.
I just created a MVP helm chart update of https://github.com/bootc/netbox-chart and deployed it successfully to our kubernetes cluster :)
I'll keep you updated.