Docker: Remove usage of gosu
and replace with su
#5951
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Replace usage of upstream
gosu
command in Docker containers.su
is available in the environment, and usingsu
should reduce security exposure vs using upstream (Ubuntu) managedgosu
dependency.At the time of writing security scanning tools such as grype/Snyk/Docker Scout are all finding issues in the
gosu
linked stdlib (from go1.19.8), which this will remediate.Test Plan
Changed were tested by:
gosu
to identify usagesdocker run -it algorand/algod:latest bash
/node/run/run.sh
to usesu
command/node/run/run.sh
Permutations tested:
ALGORAND_DATA
has been inspected (algorand:algorand
owner expected)Notes:
make
script./Dockerfile
was not done as I'm uncertain about build target to use for creating the necessary files req. in the copy step. To workaround this issue current Docker image was pulled from Docker Hub, and whererun.sh
changes subsequently were injected.