Non-root container

[alex1989hu]

Is your feature request related to a problem? Please describe.
Using nginx-prometheus-exporter in security-enhanced (like active PodSecurityPolicy) Kubernetes (or OpenShift) cluster requires non-root containers. It is common to use scratch image to reduce attack surface and get a smaller final image.

Describe the solution you'd like

• Non-root container - USER in Dockerfile
• Use scratch image

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
nginx-prometheus-exporter is written in Go, thus alpine:3.11 is not needed to run it.

[GCHQDeveloper0985]

I'm also very interested in this change being made. Any idea over what sort of time frame we can hope to see the PR merged and released?

[lucacome]

Hi @alex1989hu thanks for the PR!

I think moving to non-root container makes sense, but I'm not sure about scratch. Alpine doesn't add much overhead to the scratch image and it's pretty secure (it's like one of their main goals) and you get a shell to attach to in case you need to debug something.

Do you have any data about images size or vulnerabilities of Alpine?

Cheers.

[alex1989hu]

Hi @alex1989hu thanks for the PR!

I think moving to non-root container makes sense, but I'm not sure about scratch. Alpine doesn't add much overhead to the scratch image and it's pretty secure (it's like one of their main goals) and you get a shell to attach to in case you need to debug something.

Do you have any data about images size or vulnerabilities of Alpine?

Cheers.

Hello @lucacome, your welcome 👍 When I wrote reducing attack surface I was thinking about minimizing the possibility of arbitrary code execution. If there is no shell, then you can not do anything except running the Go binary nginx-prometheus-exporter itself. We can not predict what vulnerability will rise in the future but using SCRATCH side-effect is that it does not require to maintain and follow up alpine possible vulnerabilities.

Finally, you asked me to provide image sizes, I have good news:

Base Image	Size
alpine	19.1MB
scratch	13.6MB