From 87130f06bcf66a3de22412f0e752463999e5d31e Mon Sep 17 00:00:00 2001 From: LucasBoisserie Date: Fri, 10 Jul 2020 17:34:49 +0200 Subject: [PATCH] Run as Non Root (#149) --- build/package/Dockerfile.run | 3 +++ deployments/kubernetes/chart/reloader/values.yaml | 4 ++++ deployments/kubernetes/manifests/deployment.yaml | 3 +++ deployments/kubernetes/reloader.yaml | 3 +++ 4 files changed, 13 insertions(+) diff --git a/build/package/Dockerfile.run b/build/package/Dockerfile.run index cc51fd14..a1e9489f 100644 --- a/build/package/Dockerfile.run +++ b/build/package/Dockerfile.run @@ -5,4 +5,7 @@ RUN apk add --update --no-cache ca-certificates COPY Reloader /bin/Reloader +# On alpine 'nobody' has uid 65534 +USER 65534 + ENTRYPOINT ["/bin/Reloader"] diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml index 7e610da3..18413933 100644 --- a/deployments/kubernetes/chart/reloader/values.yaml +++ b/deployments/kubernetes/chart/reloader/values.yaml @@ -32,6 +32,10 @@ reloader: # operator: "Exists" affinity: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + # A list of tolerations to be applied to the Deployment. # Example: # tolerations: diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml index 4de0cc09..91b07058 100644 --- a/deployments/kubernetes/manifests/deployment.yaml +++ b/deployments/kubernetes/manifests/deployment.yaml @@ -39,4 +39,7 @@ spec: name: reloader-reloader args: serviceAccountName: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml index 65528f12..517a5843 100644 --- a/deployments/kubernetes/reloader.yaml +++ b/deployments/kubernetes/reloader.yaml @@ -106,6 +106,9 @@ spec: name: reloader-reloader args: serviceAccountName: reloader-reloader + securityContext: + runAsNonRoot: true + runAsUser: 65534 --- # Source: reloader/templates/role.yaml