Warning: Container Image Default User Change - Important consideration for awscontainerinsightreceiver

[PaurushGarg]

What is changing?

In v0.35.0 of the ADOT Collector the default user will change from root to aoc in the container image.
This change is necessary to implement best practices when running workload in containers, especially Least Privileges in Processes.

What Collector Configurations Could Be Affected?

If you are using awscontainerinsightreceiver in your collector configuration, then you are impacted by this change.
Running the collector as root is a pre-requirement of the awscontainerinsightreceiver , as mentioned in the component’s description here.

Migration - What do I need to do if I’m using awscontainerinsightreceiver?

To use the awscontainerinsightreceiver with version of the ADOT collector v0.35.0 and up, you will need to run the collector process as the root user. This can be accomplished in different ways, depending on the platform:

• Collector running in EKS - Use the Security context to specify the root user as owner of the collector process.

containers:
    - name: aws-otel-collector
        image: public.ecr.aws/aws-observability/aws-otel-collector:latest
        securityContext:
        runAsUser: 0
        runAsGroup: 0

• Collector running in ECS: Collector running in ECS - Use container definition to specify the User owner of the collector process.

{
  "name": "aoc-collector",
  "image": "public.ecr.aws/aws-observability/aws-otel-collector:latest",
  "user": "0:0",
  "cpu": 10,
  "memory": 256,
  ...
 }

If you have further questions on how to determine if you are affected or how to configure container user permissions with privileged access, or any other question relating to this rollout please don’t hesitate in asking!

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions]

This issue was closed because it has been marked as stale for 30 days with no activity.