feat: build non-root image variants#310
Conversation
|
@pabzm @maitredede a first test with a local Kubernetes cluster based on examples/kubernetes.yam worked as expected. This is the deployment resource I changed: apiVersion: apps/v1
kind: Deployment
metadata:
name: roundcubemail
labels:
service: roundcubemail
spec:
replicas: 1
selector:
matchLabels:
service: roundcubemail
strategy:
type: Recreate
template:
metadata:
labels:
service: roundcubemail
spec:
initContainers:
- name: init-volumes
image: alpine:latest
imagePullPolicy: IfNotPresent
command: ["sh", "-c", "chown -R 82:82 /var/www/html /tmp/roundcube-temp"]
volumeMounts:
- name: www-data
mountPath: /var/www/html
- name: temp-data
mountPath: /tmp/roundcube-temp
containers:
- name: roundcubemail
image: thomascube/roundcubemail:latest-fpm-alpine-nonroot
imagePullPolicy: Always
env: # removed for readability
ports:
- containerPort: 9000
volumeMounts:
- mountPath: /var/www/html
name: www-data
- mountPath: /tmp/roundcube-temp
name: temp-data
securityContext:
runAsUser: 82
runAsGroup: 82
restartPolicy: Always
volumes:
- name: www-data
persistentVolumeClaim:
claimName: roundcubemail-www-pvc
- name: temp-data
persistentVolumeClaim:
claimName: roundcubemail-temp-pvcI needed to add an init-container to fix the permissions of the mounted persistent volumes. The roundcube container itself runs as user 82 (www-data). In my example I enforced it using |
|
A namespace with security labels (https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/) needs more things : apiVersion: v1
kind: Namespace
metadata:
name: mailserve
labels:
pod-security.kubernetes.io/enforce: restrictedThe security context of the pod and the container must be adapted. I also added apiVersion: apps/v1
kind: Deployment
metadata:
name: roundcube
labels:
service: roundcube
spec:
replicas: 1
selector:
matchLabels:
service: roundcube
strategy:
type: Recreate
template:
metadata:
labels:
service: roundcube
spec:
securityContext:
runAsNonRoot: true
runAsUser: 82
runAsGroup: 82
fsGroup: 82
seccompProfile:
type: RuntimeDefault
# initContainers:
# - name: init-volumes
# image: alpine:latest
# imagePullPolicy: IfNotPresent
# command: ["sh", "-c", "chown -R 82:82 /var/www/html /tmp/roundcube-temp"]
# volumeMounts:
# - name: www-data
# mountPath: /var/www/html
# - name: temp-data
# mountPath: /tmp/roundcube-temp
containers:
- name: roundcubemail
image: thomascube/roundcubemail:latest-fpm-alpine-nonroot
imagePullPolicy: Always
env: # removed for readability
ports:
- containerPort: 9000
name: php-fpm
volumeMounts:
- mountPath: /var/www/html
name: www-data
- mountPath: /tmp/roundcube-temp
name: temp-data
securityContext:
# runAsUser: 82
# runAsGroup: 82
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
restartPolicy: Always
volumes:
- name: www-data
persistentVolumeClaim:
claimName: roundcubemail-www-pvc
- name: temp-data
persistentVolumeClaim:
claimName: roundcubemail-temp-pvc
```yaml |
|
I would prefer to publish the images with suffixed tags instead of a whole new namespace. It makes them more visible. docker automates using privileged ports, but e.g. podman doesn't. So to be able to run these images it would either take to explicitly set the required capability, or to run on another port. Would you be open to make the apache process listen on port 8000 or similar? That could be done with a simple line of sed in the Dockerfile: I think we should either find a way to apply a give locale, or die hard in case it is set. Silently swallowing a given locale is unpleasantly surprising to users, I think. |
OK. I wasn't sure which way to go here. Then I thought that we already have quite a matrix of tags and adding a non-root variant to it just makes it overly complex. But I'm fine with your suggestion.
I'll try to implement this.
So far I didn't succeed in finding a way without root privileges but somebody else might have an idea. |
|
@pabzm |
2 similar comments
|
@pabzm |
|
@pabzm |
|
@pabzm Sorry for the delay! Tests are finally passing. Please review again. |
|
@pabzm |
pabzm
left a comment
There was a problem hiding this comment.
This needs a rebase onto the "master" branch to build (currently fails at apt-get update), but otherwise it looks good to me! I tested the apache-nonroot image with docker and rootless podman, and both works. 👍
Adds an additional stage to the Dockerfile to create images with default user www-data. Publish as roundcube/roundcubemail-nonroot for distinction. Execution of /usr/sbin/locale-gen won't work as non-root user and thus the locale is already set in the Docker image. Refs: #306
1fee4bb to
b5c4aab
Compare
|
Rebased to master and builds are passing. |
It has been implemented by roundcube/roundcubemail-docker#310. See: https://github.com/roundcube/roundcubemail-docker/blob/master/README.md#nonroot-image - Remove added capabilities thanks to nonroot image Signed-off-by: Suguru Hirahara <did:key:z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
Adds an additional stage to the Dockerfile to create images with default user www-data. Publish as
roundcube/roundcubemail-nonrootfor distinction.Execution of /usr/sbin/locale-gen won't work as non-root user and thus the locale is already set in the Docker image.
Refs: #306