[GitHub] [pulsar] fransguelinckx commented on pull request #8242: Fix docker image permissions of /pulsar for OpenShift

[GitBox <gi...@apache.org>]

fransguelinckx commented on pull request #8242:
URL: https://github.com/apache/pulsar/pull/8242#issuecomment-770752331


   @michaeljmarshall The PR only gives the root **group** the necessary permissions to access the /pulsar folder. This is because on an openshift cluster, containers are run using a random user ID.
   
   An extract from the openshift documentation, see section "Support arbitrary user ids" (https://docs.openshift.com/container-platform/4.5/openshift_images/create-images.html)
   
   > By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node.
   
   > For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group. Files to be executed should also have group execute permissions.
   
   > Adding the following to your Dockerfile sets the directory and file permissions to allow users in the root group to access them in the built image:
   
   ```
   RUN chgrp -R 0 /some/directory && \
       chmod -R g=u /some/directory
   ```
   
   > Because the container user is always a member of the root group, the container user can read and write these files.
   
   In conclusion, I think this PR allows for better security by supporting running pulsar by an arbitrary user ID.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org