Skip to content

Commit

Permalink
Makefile/Dockerfile: fix nonroot user usage
Browse files Browse the repository at this point in the history
When using distroless tag `nonroot` we don't need to use the USER
directive in the Dockerfile.
Plus, nonroot can't write to /app or anywhere else so we should prefix
the db path with nonroot's home as well in order to avoid a sketchy
permission denied.

Signed-off-by: Antonio Murdaca <amurdaca@redhat.com>
  • Loading branch information
runcom committed Nov 4, 2024
1 parent 0207e1f commit d08b49a
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 2 deletions.
1 change: 0 additions & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ FROM gcr.io/distroless/static-debian12:nonroot

WORKDIR /app
COPY --from=builder /app/fdo_server /app/fdo_server
USER nonroot

ENTRYPOINT ["./fdo_server"]
CMD []
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ build:
# Run the Docker container with all flags
run:
${CONTAINER_RUNTIME} run -v $(PWD)/app-data:/app-data:rw --name $(CONTAINER_NAME) -d --network=$(NETWORK) $(IMAGE_NAME) \
-db $(DB_PATH) \
-db /home/nonroot/$(DB_PATH) \
$(if $(DB_PASS),-db-pass $(DB_PASS)) \
$(DEBUG) \
-http $(HTTP_ADDR) \
Expand Down

0 comments on commit d08b49a

Please sign in to comment.