Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add user to container to support running as non-root #428

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add user to container to support running as non-root #428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,11 @@ RUN apk update \
&& rm -f /var/cache/apk/* \
&& rm -rf /go/src /go/pkg

# Hardcode gid and uid so that it never changes. This changing will break
# users running this as nonroot in production as you run it with the uid directly,
# not the user name.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment is a little unclear (I'm admittedly less versed in user management) — When you say "This change will break users running this as nonroot", do you mean running the docker image as nonroot? I don't totally understand what the breaking change here is.

RUN addgroup -g 1000 hound && adduser -u 1000 -G hound -D hound

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not add USER 1000:1000 right here? Then you can skip the advice in the readme. Is there an actual reason to run hound as root, like ever?

VOLUME ["/data"]

EXPOSE 6080
Expand Down
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,12 @@ You should be able to navigate to [http://localhost:6080/](http://localhost:6080
There are no special flags to run Hound in production. You can use the `--addr=:6880` flag to control the port to which the server binds.
Currently, Hound does not support TLS as most users simply run Hound behind either Apache or nginx. However, we are open to contributions to add TLS support.

If you are running the container, it is best security practice to run containers as non-root users in production. There is a hound user and group in the container with the uid/guid of 1000/1000. For example, utilizing this user with docker would look like:

```
docker run -d -u 1000 -p 6080:6080 --name hound -v $(pwd):/data ghcr.io/hound-search/hound:latest
```

## Why Another Code Search Tool?

We've used many similar tools in the past, and most of them are either too slow, too hard to configure, or require too much software to be installed.
Expand Down