Publish :nonroot versions of images

[bradhoekstra]

Many containers do not need to be run as root, but the current published images put the work on the user to define and use a new user.

It would be nice if distroless supported a large section of those users by publishing a :nonroot version of the images similar to the nonroot example.

Related: #277

[jonjohnsonjr]

This is tricky because you start to explode the number of images when you add dimensions to the tag. There's already latest/debug and $VERSION, so you get $VERSION and $VERSION-debug.

With this would you have all of:

• $VERSION,
• $VERSION-debug,
• $VERSION-nonroot,
• $VERSION-nonroot-debug?

[chanseokoh]

@bradhoekstra if you don't have to use a human-readable name, consider using a uid number. You don't need define a new user.

[bradhoekstra]

This is tricky because you start to explode the number of images when you add dimensions to the tag.

I see your point, for some context this came up in a discussion about how to run containers as a non-root user in Knative (knative/serving#3237 (comment)). The hope was to not have to specify RunAsUser: and RunAsGroup: in k8s but to have the base image metadata do that.

@bradhoekstra if you don't have to use a human-readable name, consider using a uid number. You don't need define a new user.

Agreed that we don't necessarily need the human-readable name, but if distroless does publish a nonroot image it would be nice to add the new username for better compatibility (see #14).

[chanseokoh]

@bradhoekstra is distroless ever used in any core or required part of Knative (this will be surprising if true), or is it merely one of many public images users can choose from for their own usage? I have never seen (so far) an official image on Docker Hub with the non-root tag.

[bradhoekstra]

@bradhoekstra is distroless ever used in any core or required part of Knative (this will be surprising if true), or is it merely one of many public images users can choose from for their own usage? I have never seen (so far) an official image on Docker Hub with the non-root tag.

The standard way of building (and also releasing) Knative is by using ko which uses distroless/static:latest by default. The hope would be to override that by setting distroless/static:nonroot as the base image, or perhaps even make that the new default in ko.

[chanseokoh]

Hmm... Should this (making things run as non-root) be addressed on the ko-side then? It's not that I want to be picky; having a non-root tag in distroless may actually make sense.

However, to me doing so seems like the direction and changes mainly driven by a random external tool or program and the repo becoming to have a tie and specific to it. I'd see Distroless remain very general and minimal with a set value proposition, and I wonder if evolving the very base of the distroless repo too much for the desire to make it friendly to every external entity may sway the fundamentals of distroless and create unnecessary maintenance burden going forward. As I said, I haven't really found (so far) any official image on Docker Hub with the non-root tag, and I think that is very reasonable as general and versatile base images, given that you can easily create your own customized images from them. For example, if the ubuntu or alpine image had non-root versions, that would be a strong argument to follow suit on distroless too. Also, the repo needs to be consistent across all the languages, and adding a non-root tag means having to maintain that in Python, Java, Java-Jetty, Node, etc. IMHO, considering all these as well as the work priority on distroless, if we ever added a non-root tag, I think it would happen only after when ubuntu or such added it.

[bradhoekstra]

Thanks for the detailed response @chanseokoh, I'll look into creating the non-root image in another project.

[hazcod]

@chanseokoh to join in on the conversation: alpine and ubuntu keep user root since that's required for installing packages to the system, which is not applicable here.
And I often see people forgetting to switch to a user, even in production.

A good example is the runC escape exploit, which wasn't possible on non-root sessions.

[chanseokoh]

@hazcod I think you have a point. This issue is about having additional tags, so I'll file a new issue for more discussion about switching the base (and hence all the images) to run as non-root by default.