mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 19:17:20 +09:00
Aleksei Sviridkin
6498d37be7
CodeRabbit (PR review on #2494) flagged that the first-party scratch images leave the container process running as root because no USER directive is set. Adds the standard distroless nonroot UID/GID 65532:65532 just before ENTRYPOINT in seven first-party Dockerfiles. The chosen UID matches gcr.io/distroless/static:nonroot and the existing convention in the kubevirt-csi-driver and kamaji images. Statically-linked Go binaries copied with default permissions remain world-readable, so they execute fine under the non-root identity without an extra chown step in the builder stage. Touched: - packages/system/backup-controller/images/backup-controller/Dockerfile - packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile - packages/system/cozystack-api/images/cozystack-api/Dockerfile - packages/system/dashboard/images/token-proxy/Dockerfile - packages/system/flux-plunger/images/flux-plunger/Dockerfile - packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile - packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile Vendored Dockerfiles (kubevirt-cloud-provider, redis-operator, keycloak-operator, linstor-csi, multus-cni, objectstorage, s3manager, kamaji, cluster-autoscaler) are intentionally left untouched — their runtime user choice is upstream's call. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>