Skip to content

create non-root users for containers #3020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rcmadhankumar wants to merge 2 commits into
base: main
Choose a base branch
from
Open

create non-root users for containers #3020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a3d02a
Add user create flag to create stable user if the user deosn't exist
rcmadhankumar Oct 17, 2025
c597281
create non-root users for cli containers
rcmadhankumar Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/bci_build/package/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,6 @@ class Package:
def __str__(self) -> str:
return self.name


@dataclass
class StableUser:
"""Data class that stores information about stable user and group
Expand All @@ -87,7 +86,8 @@ class StableUser:
group_name: str
# id of the group
group_id: int

# boolean flag that checks if user needs to be created
user_create: bool = False

def _build_tag_prefix(os_version: OsVersion) -> str:
if os_version == OsVersion.TUMBLEWEED:
Expand Down
9 changes: 9 additions & 0 deletions src/bci_build/package/git.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
from bci_build.os_version import ALL_NONBASE_OS_VERSIONS
from bci_build.os_version import CAN_BE_LATEST_OS_VERSION
from bci_build.package import ApplicationStackContainer
from bci_build.package import StableUser
from bci_build.package.helpers import generate_from_image_tag
from bci_build.package.helpers import generate_package_version_check
from bci_build.package.versions import format_version
Expand Down Expand Up @@ -42,10 +43,18 @@
package_list=[
"git-core",
"openssh-clients",
"shadow"
],
build_stage_custom_end=generate_package_version_check(
"git-core", git_version, ParseVersion.MINOR, use_target=True
),
user_chown=StableUser(
Copy link
Copy Markdown
Member

@alexandrevicenzi alexandrevicenzi Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need to create a user for Git and such containers? All we need is to set correct file permissions so that it can run with any user.

However, if we go with a Git user, at least the container should use it, which it does not seem to use right now, so this change has not much of an effect on the image.

user_id=1000,
user_name="git",
group_id=1000,
group_name="git",
user_create=True
),
)
for os_version in ALL_NONBASE_OS_VERSIONS
]
9 changes: 9 additions & 0 deletions src/bci_build/package/helm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
from bci_build.os_version import ALL_NONBASE_OS_VERSIONS
from bci_build.os_version import CAN_BE_LATEST_OS_VERSION
from bci_build.package import ApplicationStackContainer
from bci_build.package import StableUser
from bci_build.package.helpers import generate_from_image_tag
from bci_build.package.helpers import generate_package_version_check
from bci_build.package.versions import format_version
Expand Down Expand Up @@ -36,7 +37,15 @@
package_list=[
"ca-certificates-mozilla",
"helm",
"shadow",
],
user_chown=StableUser(
user_id=1000,
user_name="helm",
group_id=1000,
group_name="helm",
user_create=True
),
replacements_via_service=[
Replacement(
regex_in_build_description="%%helm_version%%",
Expand Down
10 changes: 9 additions & 1 deletion src/bci_build/package/kubectl.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
from bci_build.os_version import CAN_BE_LATEST_OS_VERSION
from bci_build.os_version import OsVersion
from bci_build.package import ApplicationStackContainer
from bci_build.package import StableUser
from bci_build.package.helpers import generate_from_image_tag
from bci_build.replacement import Replacement
from bci_build.util import ParseVersion
Expand Down Expand Up @@ -61,7 +62,14 @@ def _get_kubectl_stability_tag(version: str, os_version: OsVersion) -> str | Non
parse_version=ParseVersion.PATCH,
)
],
package_list=[f"kubernetes{ver}-client"],
package_list=[f"kubernetes{ver}-client", "shadow"],
user_chown=StableUser(
user_id=1000,
user_name="kubectl",
group_id=1000,
group_name="kubectl",
user_create=True
),
entrypoint=["kubectl"],
license="Apache-2.0",
support_level=SupportLevel.L3,
Expand Down
17 changes: 17 additions & 0 deletions src/bci_build/package/samba.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
from bci_build.package import DOCKERFILE_RUN
from bci_build.package import ApplicationStackContainer
from bci_build.package import OsVersion
from bci_build.package import StableUser
from bci_build.package.helpers import generate_from_image_tag
from bci_build.package.helpers import generate_package_version_check
from bci_build.package.versions import get_pkg_version
Expand Down Expand Up @@ -121,7 +122,15 @@
license="GPL-3.0-or-later",
package_list=[
"samba-client",
"shadow"
],
user_chown=StableUser(
user_id=1000,
user_name="smbc",
group_id=1000,
group_name="smbc",
user_create=True
),
)

toolbox = ApplicationStackContainer(
Expand Down Expand Up @@ -149,9 +158,17 @@
package_list=[
"samba-client",
"tdb-tools",
"shadow",
]
# FIXME: unavailable on SLES
+ (["samba-test"] if os_version.is_tumbleweed else []),
user_chown=StableUser(
user_id=1000,
user_name="smbc",
group_id=1000,
group_name="smbc",
user_create=True
),
)

SAMBA_SERVER_CONTAINERS.append(srv)
Expand Down
8 changes: 7 additions & 1 deletion src/bci_build/templates.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,19 @@
{% endif -%} zypper -n {%- if image.from_target_image %} --installroot /target --gpg-auto-import-keys {%- endif %} install {% if image.no_recommends %}--no-recommends {% endif %}{{ image.packages }}{%- if image.packages_to_delete %}; \\
zypper -n {%- if image.from_target_image %} --installroot /target {%- endif %} remove {{ image.packages_to_delete }}{%- endif %}
{%- endif %}
{%- if image.user_chown %}
{%- if image.user_chown and not image.user_chown.user_create%}
# changing user id and group id created by package installation to stable values
{{ DOCKERFILE_RUN }} \\
{% if image.from_target_image %}chroot /target {% endif %}chown -R --from={{ image.user_chown.user_name }}:{{ image.user_chown.group_name }} {{ image.user_chown.user_id }}:{{ image.user_chown.group_id }} /; \\
groupmod {% if image.from_target_image %}-R /target {% endif %}-g {{ image.user_chown.group_id }} {{ image.user_chown.group_name }}; \\
usermod {% if image.from_target_image %}-R /target {% endif %}-u {{ image.user_chown.user_id }} {{ image.user_chown.user_name }}
{%- endif %}
{%- if image.user_chown and image.user_chown.user_create%}
# create the user and group with the given ids
{{ DOCKERFILE_RUN }} \\
groupadd {% if image.from_target_image %}-R /target {% endif %}-g {{ image.user_chown.group_id }} -r {{ image.user_chown.group_name }}; \\
useradd {% if image.from_target_image %}-R /target {% endif %}-u {{ image.user_chown.user_id }} -g {{ image.user_chown.group_id }} -m -r -s /bin/bash {{ image.user_chown.user_name }}
{%- endif %}
{%- if image.build_stage_custom_end %}
{{ image.build_stage_custom_end }}
{%- endif %}
Expand Down
Loading