possible to run apicurio-registry-mssql container without root permissions ; userid>999 #3258
Labels
Comments
jsenko
added a commit
to jsenko/apicurio-registry
that referenced
this issue
Apr 5, 2023
jsenko
added a commit
to jsenko/apicurio-registry
that referenced
this issue
Apr 5, 2023
jsenko
added a commit
to jsenko/apicurio-registry
that referenced
this issue
Apr 6, 2023
riprasad
pushed a commit
to jsenko/apicurio-registry
that referenced
this issue
Apr 27, 2023
jsenko
added a commit
to jsenko/apicurio-registry
that referenced
this issue
Apr 27, 2023
EricWittmann
pushed a commit
that referenced
this issue
May 29, 2023
* feat: do not run images under root UID/GID Resolves #3258 * Support arbitrary user ids --------- Co-authored-by: Rishab Prasad <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Feature or Problem Description
The docker container apicurio-registry-mssql runs under user jboss and root group.
this is not possible in a hardended rke2 environment due cis 1.6 and pod security policy global-restricted-psp where it isn't possible to run containers with userid/grpid < 1000 and root permissions
Proposed Solution
run the apicurio-registry-mssql docker container without root permissions (Non-Privileged User) and userid/grpid>999 which is a obligation in a restricted / hardenend environment
Additional Context
https://snyk.io/blog/10-kubernetes-security-context-settings-you-should-understand/
https://github.com/Apicurio/apicurio-registry/blob/main/distro/docker/src/main/docker/Dockerfile.mssql.jvm
The text was updated successfully, but these errors were encountered: