From e89bd3eebd9174addb4af4c03d8a5d2d653de7f9 Mon Sep 17 00:00:00 2001 From: Lishen Yao Date: Tue, 29 Aug 2023 18:13:21 +0800 Subject: [PATCH 1/3] [improve][sec] Change user pulsar's gid to pulsar instead of root --- docker/pulsar/Dockerfile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docker/pulsar/Dockerfile b/docker/pulsar/Dockerfile index 593401f57be8c..24d27b0379a01 100644 --- a/docker/pulsar/Dockerfile +++ b/docker/pulsar/Dockerfile @@ -93,7 +93,12 @@ RUN mkdir /pulsar && chmod g+w /pulsar ENV PULSAR_ROOT_LOGGER=INFO,CONSOLE -COPY --from=pulsar /pulsar /pulsar +RUN groupadd -g 10000 pulsar && \ + useradd -r -u 10000 -g pulsar pulsar + +COPY --from=pulsar --chown=10000:10000 /pulsar /pulsar +RUN chown pulsar:pulsar /pulsar + WORKDIR /pulsar ARG PULSAR_CLIENT_PYTHON_VERSION @@ -104,4 +109,4 @@ RUN chmod +x /pulsar/bin/install-pulsar-client.sh RUN /pulsar/bin/install-pulsar-client.sh # The UID must be non-zero. Otherwise, it is arbitrary. No logic should rely on its specific value. -USER 10000 +USER 10000:10000 From adcd863dfd0d13162dbdcdb6ed7fead7e4a92f5f Mon Sep 17 00:00:00 2001 From: Lishen Yao Date: Thu, 7 Dec 2023 10:01:32 +0800 Subject: [PATCH 2/3] [improve][sec] Fix test dockerfiles user permission --- tests/docker-images/java-test-image/Dockerfile | 6 +++--- tests/docker-images/latest-version-image/Dockerfile | 4 ---- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/tests/docker-images/java-test-image/Dockerfile b/tests/docker-images/java-test-image/Dockerfile index 5821e6eeaeae7..5a64aec96151a 100644 --- a/tests/docker-images/java-test-image/Dockerfile +++ b/tests/docker-images/java-test-image/Dockerfile @@ -19,8 +19,8 @@ FROM ubuntu:22.04 -RUN groupadd -g 10001 pulsar -RUN adduser -u 10000 --gid 10001 --disabled-login --disabled-password --gecos '' pulsar +RUN groupadd -g 10000 pulsar && \ + useradd -r -u 10000 -g pulsar --disabled-login --disabled-password --gecos '' pulsar ARG PULSAR_TARBALL=target/pulsar-server-distribution-bin.tar.gz ADD ${PULSAR_TARBALL} / @@ -75,7 +75,7 @@ COPY target/java-test-functions.jar /pulsar/examples/ ENV PULSAR_ROOT_LOGGER=INFO,CONSOLE -RUN chown -R pulsar:0 /pulsar && chmod -R g=u /pulsar +RUN chown -R pulsar:pulsar /pulsar # cleanup RUN apt-get -y --purge autoremove \ diff --git a/tests/docker-images/latest-version-image/Dockerfile b/tests/docker-images/latest-version-image/Dockerfile index 99672773dcbc8..602f917700b65 100644 --- a/tests/docker-images/latest-version-image/Dockerfile +++ b/tests/docker-images/latest-version-image/Dockerfile @@ -40,10 +40,6 @@ FROM apachepulsar/pulsar:latest # However, any processes exec'ing into the containers will run as root, by default. USER root -# We need to define the user in order for supervisord to work correctly -# We don't need a user defined in the public docker image, though. -RUN adduser -u 10000 --gid 0 --disabled-login --disabled-password --gecos '' pulsar - RUN rm -rf /var/lib/apt/lists/* && apt update RUN apt-get clean && apt-get update && apt-get install -y supervisor vim procps curl From 5c632ba741cc925ae71624cf6cff8e04fe4b81c9 Mon Sep 17 00:00:00 2001 From: Lishen Yao Date: Thu, 7 Dec 2023 10:28:29 +0800 Subject: [PATCH 3/3] [improve][sec] Fix test dockerfiles user permission --- tests/docker-images/java-test-image/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/docker-images/java-test-image/Dockerfile b/tests/docker-images/java-test-image/Dockerfile index 5a64aec96151a..7f30d756e1826 100644 --- a/tests/docker-images/java-test-image/Dockerfile +++ b/tests/docker-images/java-test-image/Dockerfile @@ -20,7 +20,7 @@ FROM ubuntu:22.04 RUN groupadd -g 10000 pulsar && \ - useradd -r -u 10000 -g pulsar --disabled-login --disabled-password --gecos '' pulsar + useradd -r -u 10000 -g pulsar pulsar ARG PULSAR_TARBALL=target/pulsar-server-distribution-bin.tar.gz ADD ${PULSAR_TARBALL} /