feat: Run /docker-entrypoint.d/ scripts as root
#4568
Conversation
RulerOf
requested review from
chenrui333,
lukemassa and
X-Guardian
and removed request for
a team
RulerOf
changed the title
/docker-entrypoint.d/ scripts as root/docker-entrypoint.d/ scripts as root
Previous behavior was to only use `gosu` if Atlantis was being run
|
I'm not a maintainer, but my 50c is that if you want to modify the Atlantis Docker image, modify it by building a custom image and installing the software needed through that - or tweak your Allowing the container to start as Could probably circumvent this by introducing a Don't get me wrong, I can absolutely see the value of having this capability, but its a pretty significant trade-off beyond the (rather straight forward) change. Perhaps documenting how to run the container as 🤔 perhaps leaving |
| @@ -164,10 +165,13 @@ RUN apk add --no-cache \ | |||
| bash~=5 \ | |||
| openssh~=9 \ | |||
| dumb-init~=1 \ | |||
| gcompat~=1 | |||
| gcompat~=1 \ | |||
| su-exec~=0 | |||
There was a problem hiding this comment.
I'm not familiar with Alpine, but is there a reason for using su-exec instead of gosu proper?
There was a problem hiding this comment.
The gosu readme suggested su-exec specifically for alpine users since they do the same thing. See Install.md from gosu repo.
There was a problem hiding this comment.
Ah, I wonder if its recommended purely from size POV or technical reasons - if its pure size, I would probably prefer the native gosu to keep the number of moving parts (and attack/bug vectors) low.
I know alpine users generally are obsessed with shaving bytes off images, but in this case the trade-off doesn't seem favourable in that regard to me.
If there are stability/technical reasons for it, thats of course a different story entirely :)
(again, not a maintainer, just an active user of Atlantis voicing an opinion)
Was thinking about this some more. If there's an appetite amongst the maintainers for a separate image tag, my needs would be well-suited by something like a We could survey the terraform What do you think @jippi ? |
This is a difficult one, and I will say I will be opposed since it will require more maintenance for us and be a big security issue for most. I would like to know more about what you are trying to install that requires root and can't be compiled/run using an alternative user. |
|
Another thing will be to add |
jamengual
added
needs discussion
sudo Is not a viable option. I was checking to see if you can install Python on the user folder, and it is possible using the |
Totally agree; |
It does sound like a pretty cool "sidecar" project to Atlantis for the broader community to build out; but doesn't align well with the conservative (and security-first) approach a tool like Atlantis should always take; and as mentioned, would be significant burden on an already very busy maintainer team :) |
| @@ -59,6 +59,7 @@ RUN apt-get update && \ | |||
| unzip \ | |||
| openssh-server \ | |||
| dumb-init \ | |||
| gosu \ | |||
There was a problem hiding this comment.
We can avoid adding gosu by splitting up the directory run from the docker entry point.
|
I dont think we should do such things (for whom might use this, they should build their own docker image). closing for now. Sorry about it. |
what
why
apk add/apt-get installrequire root)tests
Containers built as
atltest.Runs
CMDas atlantis user:Debian
Alpine
Entrypoint script runs as root and successfully installs software. CMD is run as atlantis user:
Debian
Alpine
references