Update: Run container as a non-root user (#154)

* Add yamllint config

* Update npm packages

* Set a security policy to run as the node user

* Update docker image build for non-root

* Discontinue use of npm-watch

* Fix resource yaml errors

* Limit volume mount permissions

* Update volume mount paths

.dockerignore

@@ -12,3 +12,4 @@ test/
 kubernetes/
 .env/
 testdata/
+.*

.travis.yml

@@ -1,6 +1,6 @@
 language: node_js
 node_js:
-  - "11"
+  - "lts/*"
 
 services:
   - docker

.yamllint

@@ -0,0 +1,8 @@
+extends: relaxed
+
+rules:
+  line-length:
+    max: 180
+    level: warning
+  empty-lines:
+    max: 1

Dockerfile

@@ -13,22 +13,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 ################################################################################
-FROM node:alpine as buildImg
+FROM node:lts-alpine as buildImg
 
 RUN apk update
 RUN apk --no-cache add gnupg python make curl
 
-RUN mkdir -p /usr/src/app
-ENV PATH="$PATH:/usr/src/app"
-WORKDIR /usr/src/app
-COPY . /usr/src/app
+USER node
+WORKDIR /home/node
+
+COPY --chown=node . /home/node
 RUN npm install --production --loglevel=warn
+RUN node -v
+
+#######################################
+# Build the production image
+FROM node:lts-alpine
 
+USER node
+WORKDIR /home/node
 
-FROM node:alpine
-RUN apk add --upgrade --no-cache libssl1.1
-RUN mkdir -p /usr/src/app
-ENV PATH="$PATH:/usr/src/app"
-WORKDIR /usr/src/app
-COPY --from=buildImg /usr/src/app /usr/src/app
+COPY --chown=node --from=buildImg /home/node /home/node
 CMD ["npm", "start"]

build/process-template.sh

@@ -23,6 +23,11 @@ export TRAVIS_COMMIT
 GIT_REMOTE="$(git remote get-url origin)"
 export GIT_REMOTE
 
+NODE_USER_ID="$(docker run -it node:lts-alpine /usr/bin/id -u node | tr -d '\r' | tr -d '\n')"
+export NODE_USER_ID
+NODE_GROUP_ID="$(docker run -it node:lts-alpine /usr/bin/id -g node | tr -d '\r' | tr -d '\n')"
+export NODE_GROUP_ID
+
 envsubst <"${THIS_DIR}/viewTemplate.json" >/tmp/view.json
 
 npx mustache /tmp/view.json "${FILE}"

build/viewTemplate.json

@@ -1,5 +1,7 @@
 {
   "TRAVIS_COMMIT": "${TRAVIS_COMMIT}",
   "TRAVIS_TAG": "${TRAVIS_TAG}",
-  "GIT_REMOTE": "${GIT_REMOTE}"
+  "GIT_REMOTE": "${GIT_REMOTE}",
+  "NODE_USER_ID": "${NODE_USER_ID}",
+  "NODE_GROUP_ID": "${NODE_GROUP_ID}"
 }

kubernetes/watch-keeper/rbac.yaml

@@ -3,7 +3,7 @@ kind: List
 metadata:
   name: watch-keeper-deployment
   annotations:
-    version: "{{TRAVIS_COMMIT}}"
+    version: "{{{TRAVIS_COMMIT}}}"
 type: array
 items:
   - apiVersion: v1
@@ -15,24 +15,24 @@ items:
         deploy.razee.io/Reconcile: "false"
       annotations:
         razee.io/git-repo: "{{{GIT_REMOTE}}}"
-        razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
 
   - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: cluster-reader
       annotations:
         razee.io/git-repo: "{{{GIT_REMOTE}}}"
-        razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
     rules:
-    - apiGroups:
-      - '*'
-      resources:
-      - '*'
-      verbs: ["get", "list", "watch"]
-    - nonResourceURLs:
-      - '*'
-      verbs: ["get", "list", "watch"]
+      - apiGroups:
+          - '*'
+        resources:
+          - '*'
+        verbs: ["get", "list", "watch"]
+      - nonResourceURLs:
+          - '*'
+        verbs: ["get", "list", "watch"]
 
   - apiVersion: v1
     kind: ServiceAccount
@@ -41,23 +41,23 @@ items:
       namespace: razee
       annotations:
         razee.io/git-repo: "{{{GIT_REMOTE}}}"
-        razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
 
   - apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: watch-keeper-rb
       annotations:
         razee.io/git-repo: "{{{GIT_REMOTE}}}"
-        razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: ClusterRole
       name: cluster-reader
     subjects:
-    - kind: ServiceAccount
-      name: watch-keeper-sa
-      namespace: razee
+      - kind: ServiceAccount
+        name: watch-keeper-sa
+        namespace: razee
 
   - kind: NetworkPolicy
     apiVersion: networking.k8s.io/v1
@@ -66,11 +66,11 @@ items:
       namespace: razee
       annotations:
         razee.io/git-repo: "{{{GIT_REMOTE}}}"
-        razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+        razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
     spec:
       podSelector:
         matchLabels:
           app: watch-keeper
       policyTypes:
-      - Ingress
+        - Ingress
       ingress: []

kubernetes/watch-keeper/resource.yaml

@@ -2,9 +2,9 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    version: "{{TRAVIS_COMMIT}}"
+    version: "{{{TRAVIS_COMMIT}}}"
     razee.io/git-repo: "{{{GIT_REMOTE}}}"
-    razee.io/commit-sha: "{{TRAVIS_COMMIT}}"
+    razee.io/commit-sha: "{{{TRAVIS_COMMIT}}}"
   name: watch-keeper
   labels:
     razee/watch-resource: "lite"
@@ -24,47 +24,52 @@ spec:
       name: watch-keeper
     spec:
       serviceAccountName: watch-keeper-sa
+      securityContext:
+        runAsUser: {{{NODE_USER_ID}}}
+        runAsGroup: {{{NODE_GROUP_ID}}}
+        fsGroup: {{{NODE_GROUP_ID}}}
       containers:
-      - env:
-          - name: NAMESPACE
-            valueFrom:
-              fieldRef:
-                fieldPath: metadata.namespace
-          - name: NODE_ENV
-            value: "production"
-          - name: KUBECONFIG
-            valueFrom:
-              configMapKeyRef:
-                name: watch-keeper-config
-                key: KUBECONFIG
-                optional: true
-        image: "quay.io/razee/watch-keeper:{{TRAVIS_TAG}}"
-        imagePullPolicy: Always
-        name: watch-keeper
-        resources:
-          limits:
-            memory: 500Mi
-            cpu: 400m
-          requests:
-            memory: 100Mi
-            cpu: 50m
-        livenessProbe:
-          exec:
-            command:
-            - sh/liveness.sh
-          initialDelaySeconds: 600
-          periodSeconds: 300
-          timeoutSeconds: 30
-          failureThreshold: 1
-        volumeMounts:
-          - name: watch-keeper-config
-            mountPath: /usr/src/app/envs/watch-keeper-config
-          - name: watch-keeper-secret
-            mountPath: /usr/src/app/envs/watch-keeper-secret
-          - name: razee-identity-config
-            mountPath: /usr/src/app/envs/razee-identity-config
-          - name: razee-identity-secret
-            mountPath: /usr/src/app/envs/razee-identity-secret
+        - env:
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NODE_ENV
+              value: "production"
+            - name: KUBECONFIG
+              valueFrom:
+                configMapKeyRef:
+                  name: watch-keeper-config
+                  key: KUBECONFIG
+                  optional: true
+          image: "quay.io/razee/watch-keeper:{{{TRAVIS_TAG}}}"
+          imagePullPolicy: Always
+          name: watch-keeper
+          resources:
+            limits:
+              memory: 500Mi
+              cpu: 400m
+            requests:
+              memory: 100Mi
+              cpu: 50m
+          livenessProbe:
+            exec:
+              command:
+                - sh/liveness.sh
+            initialDelaySeconds: 600
+            periodSeconds: 300
+            timeoutSeconds: 30
+            failureThreshold: 1
+            successThreshold: 1
+          volumeMounts:
+            - name: watch-keeper-config
+              mountPath: /home/node/envs/watch-keeper-config
+            - name: watch-keeper-secret
+              mountPath: /home/node/envs/watch-keeper-secret
+            - name: razee-identity-config
+              mountPath: /home/node/envs/razee-identity-config
+            - name: razee-identity-secret
+              mountPath: /home/node/envs/razee-identity-secret
       volumes:
         - name: watch-keeper-config
           configMap: