[GitHub] [airflow] potiuk commented on a change in pull request #19315: pgbouncer exporter version update

[GitBox <gi...@apache.org>]

potiuk commented on a change in pull request #19315:
URL: https://github.com/apache/airflow/pull/19315#discussion_r739676132



##########
File path: chart/dockerfiles/pgbouncer-exporter/Dockerfile
##########
@@ -28,13 +28,19 @@ LABEL org.apache.airflow.airflow-pgbouncer-exporter.version="${AIRFLOW_PGBOUNCER
 LABEL org.apache.airflow.commit-sha="${COMMIT_SHA}"
 LABEL maintainer="Apache Airflow Community <de...@airflow.apache.org>"
 
+# Add a non root user
+RUN addgroup -S pgbouncer_exporter \

Review comment:
       How about using user "nobody" (Like in the pgbouncer itself). I think this case is not the same as airflow - in airflow often people want to use different user or use the "arbitrary user id" to avoid some potential "user' clashes between containers running on the same machine and they evn might want to choose a specific ID because they can have volumes mounted with specific users etc. So it makes sense to support the "arbitrary user id". We also created a home directory there because airflow workers might spawn pretty much arbitrary operators (thus any external libraries/binaries) and many of those extarnal binaries/librraries might rely on the ${HOME} directory set and present (and writeable) - for example when they do any caching, they often do that in the ${HOME} dir.
   
   But `pgbouncer_exporter` is really simple, "standalone" binary tool that is rather simple - it connects to pgbouncer, queries it for stats and exposes to prometheus via non-priviledged port (9127 which is > 1024) - so there is no need for any special priviledges, also it is unlikely it needs HOME directory (we can check that likely).
   
   This is nobody user:
   
   ```
   nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
   ```
   
   WDYT?




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org