FLPATH-4764 | [dcm-ui] Helm-deployed dcm-ui crashloops on OpenShift due to /app directory permissions (mode 700)

[asmasarw]

• chown -R node:0 /app: Changes group ownership from node (GID 1000) to root (GID 0).

• chmod -R g=u /app: Ensures every file and directory has identical permissions for group members as the node user. Directories become drwxrwxr-x, allowing OpenShift’s random UID in GID 0 to enter /app and load modules.

• USER 1000: Explicit UIDs (instead of the named string USER node) are standard for OCI containers, though both work once GID 0 permissions are in place.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Make DCM image OpenShift arbitrary-UID compatible by fixing /app ownership

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Adjust /app ownership and permissions to support OpenShift arbitrary UID execution
• Switch /app group ownership to root (GID 0) and mirror user perms to group
• Run the container as a non-root numeric UID for runtime compatibility

Diagram

graph TD
  A["workspaces/dcm/Dockerfile"] --> B["DCM runtime image"] --> C[("/app tree")] --> D(["Backstage node process"]) --> E["Backend port 7007"]
  F["OpenShift (arbitrary UID)"] --> D

  subgraph Legend
    direction LR
    _file["File/config"] ~~~ _proc(["Process"]) ~~~ _fs[("Filesystem")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use chgrp 0 + g+rwX instead of g=u

• ➕ More targeted: avoids making group permissions as permissive as user execute bits everywhere
• ➕ Common OpenShift pattern: chgrp -R 0 + chmod -R g+rwX is widely used
• ➖ May still miss cases where user permissions are more complex than rwX (e.g., special modes)
• ➖ You must ensure execute bits are correct for directories/binaries (rwX helps, but differs from exact mirroring)

2. Remove fixed USER and let the platform assign UID

• ➕ Maximizes compatibility with OpenShift restricted SCC and other platforms that enforce arbitrary UID
• ➕ Avoids assumptions about UID 1000 existing/being allowed at runtime
• ➖ Loses a clear non-root default when running the image locally outside OpenShift
• ➖ May require additional documentation or runtime configuration (runAsNonRoot) to keep security posture consistent

3. Limit recursive chmod/chown to only writable paths

• ➕ Reduces risk of unintentionally changing permissions for all files under /app
• ➕ Faster image build/runtime startup on large trees
• ➖ Requires deeper knowledge of which subpaths need write access (cache, temp, configs)
• ➖ Higher chance of missing a path and reintroducing OpenShift runtime failures

Recommendation: The current approach (set group to GID 0 and mirror user permissions via chmod -R g=u) is a solid OpenShift compatibility pattern and keeps the change small. The main strategic question is whether USER 1000 should remain fixed; if OpenShift is the primary target, consider removing the fixed USER (or clearly documenting that OpenShift will override it) to avoid any residual UID assumptions.

Files changed (1) +6 / -2

Bug fix (1) +6 / -2

DockerfileFix /app permissions for OpenShift arbitrary UID runtime +6/-2

Fix /app permissions for OpenShift arbitrary UID runtime

• Replaces 'chown -R node:node /app' with 'chown -R node:0 /app' and mirrors user permissions to group ('chmod -R g=u'). This aligns the image with OpenShift’s arbitrary UID model (typically running with GID 0) while keeping a non-root runtime user ('USER 1000').

workspaces/dcm/Dockerfile

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Overwritable /app tree 🐞 Bug ⛨ Security

Description

chmod -R g=u /app mirrors owner permissions to group across the entire application tree, making
any owner-writable code/dependency/config files under /app also writable by the container’s group.
On OpenShift, where the arbitrary UID commonly runs with group 0, this unnecessarily allows runtime
modification of the installed application contents, increasing impact of bugs or compromise.

Code

workspaces/dcm/Dockerfile[R81-82]

+RUN chown -R node:0 /app && \
+    chmod -R g=u /app

Relevance

●● Moderate

Security hardening vs stated OpenShift compatibility goal; no close prior on chmod g=u /app
behavior.

PR-#2847
PR-#4075

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR explicitly changes /app to be owned by group 0 and then recursively mirrors user
permissions to group permissions for everything under /app, which makes owner-writable files and
directories group-writable as well.

workspaces/dcm/Dockerfile[79-84]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`chmod -R g=u /app` makes large parts of the shipped application (including code and dependencies) group-writable. For OpenShift arbitrary-UID compatibility, it’s usually sufficient to grant group-0 write permissions only to the specific runtime-writable directories (cache/tmp/data), while keeping the rest of `/app` read-only.

## Issue Context
The PR currently applies permission mirroring to all of `/app` after changing group ownership to GID 0.

## Fix Focus Areas
- workspaces/dcm/Dockerfile[79-84]

## Suggested change
- Replace the broad `chmod -R g=u /app` with a narrower set of paths that the running Backstage/Node process actually needs to write to (e.g., explicitly `mkdir -p` a cache/data directory under `/app` or use `/tmp`) and apply `chgrp 0` + `chmod g=u` only there.
- Keep the rest of `/app` readable/executable for group 0, but not writable (avoid enabling group write on application code and `node_modules`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh-local (sha: a1776caa)

  Explored: repo: redhat-developer/rhdh-operator (sha: 7f909449)

  Not relevant to this PR: redhat-developer/rhdh

  Not relevant to this PR: redhat-developer/rhdh-chart

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.06%. Comparing base (8c14679) to head (e69a208).
⚠️ Report is 21 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4171   +/-   ##
=======================================
  Coverage   58.06%   58.06%           
=======================================
  Files        2411     2411           
  Lines       96367    96367           
  Branches    26856    26859    +3     
=======================================
  Hits        55953    55953           
+ Misses      40215    40179   -36     
- Partials      199      235   +36     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 8c14679
ai-integrations	69.71% <ø> (ø)		Carriedforward from 8c14679
app-defaults	69.79% <ø> (ø)		Carriedforward from 8c14679
augment	46.67% <ø> (ø)		Carriedforward from 8c14679
boost	76.77% <ø> (ø)		Carriedforward from 8c14679
bulk-import	72.56% <ø> (ø)		Carriedforward from 8c14679
cost-management	13.55% <ø> (ø)		Carriedforward from 8c14679
dcm	60.72% <ø> (ø)
extensions	56.59% <ø> (ø)		Carriedforward from 8c14679
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 8c14679
global-header	66.50% <ø> (ø)		Carriedforward from 8c14679
homepage	47.50% <ø> (ø)		Carriedforward from 8c14679
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from 8c14679
intelligent-assistant	74.61% <ø> (ø)		Carriedforward from 8c14679
konflux	91.98% <ø> (ø)		Carriedforward from 8c14679
lightspeed	69.02% <ø> (ø)		Carriedforward from 8c14679
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 8c14679
orchestrator	66.87% <ø> (ø)		Carriedforward from 8c14679
quickstart	63.74% <ø> (ø)		Carriedforward from 8c14679
sandbox	79.56% <ø> (ø)		Carriedforward from 8c14679
scorecard	85.45% <ø> (ø)		Carriedforward from 8c14679
theme	88.52% <ø> (ø)		Carriedforward from 8c14679
translations	5.12% <ø> (ø)		Carriedforward from 8c14679
x2a	79.20% <ø> (ø)		Carriedforward from 8c14679

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c14679...e69a208. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.