[GitHub] vvraskin closed pull request #3579: Using non root user in controller

[GitBox <gi...@apache.org>]

vvraskin closed pull request #3579: Using non root user in controller
URL: https://github.com/apache/incubator-openwhisk/pull/3579
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/ansible/group_vars/all b/ansible/group_vars/all
old mode 100644
new mode 100755
index 4229701b43..8265c4a1c1
--- a/ansible/group_vars/all
+++ b/ansible/group_vars/all
@@ -106,7 +106,7 @@ jmx:
   rmiBasePortInvoker: 18000
   user: "{{ jmxuser | default('jmxuser') }}"
   pass: "{{ jmxuser | default('jmxpass') }}"
-  jvmCommonArgs: "-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.password.file=/root/jmxremote.password -Dcom.sun.management.jmxremote.access.file=/root/jmxremote.access"
+  jvmCommonArgs: "-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.password.file=/home/owuser/jmxremote.password -Dcom.sun.management.jmxremote.access.file=/home/owuser/jmxremote.access"
   enabled: "{{ jmxremote_enabled | default('true') }}"
 
 transactions:
diff --git a/common/scala/copyJMXFiles.sh b/common/scala/copyJMXFiles.sh
index 82b6fbb760..85265b7f1a 100644
--- a/common/scala/copyJMXFiles.sh
+++ b/common/scala/copyJMXFiles.sh
@@ -18,6 +18,6 @@
 
 if [[ $( ls /conf/jmxremote.* 2> /dev/null ) ]]
 then
-  mv /conf/jmxremote.* /root
-  chmod 600 /root/jmxremote.*
+  mv /conf/jmxremote.* /home/owuser
+  chmod 600 /home/owuser/jmxremote.*
 fi
diff --git a/core/controller/Dockerfile b/core/controller/Dockerfile
index 23e274d0b0..151444f277 100644
--- a/core/controller/Dockerfile
+++ b/core/controller/Dockerfile
@@ -3,6 +3,9 @@
 
 FROM scala
 
+ENV UID=1001 \
+    NOT_ROOT_USER=owuser
+
 # Install swagger-ui
 RUN curl -sSL -o swagger-ui-v3.6.0.tar.gz --no-verbose https://github.com/swagger-api/swagger-ui/archive/v3.6.0.tar.gz && \
     mkdir swagger-ui && \
@@ -10,12 +13,14 @@ RUN curl -sSL -o swagger-ui-v3.6.0.tar.gz --no-verbose https://github.com/swagge
     rm swagger-ui-v3.6.0.tar.gz && \
     sed -i s#http://petstore.swagger.io/v2/swagger.json#/api/v1/api-docs#g /swagger-ui/index.html
 
-#
 # Copy app jars
 ADD build/distributions/controller.tar /
 
 COPY init.sh /
 RUN chmod +x init.sh
 
+RUN adduser -D -u ${UID} -h /home/${NOT_ROOT_USER} -s /bin/bash ${NOT_ROOT_USER}
+USER ${NOT_ROOT_USER}
+
 EXPOSE 8080
 CMD ["./init.sh", "0"]
diff --git a/core/controller/Dockerfile.cov b/core/controller/Dockerfile.cov
index 035ce29130..fc0430e19e 100644
--- a/core/controller/Dockerfile.cov
+++ b/core/controller/Dockerfile.cov
@@ -5,6 +5,7 @@ FROM controller
 
 ARG OW_ROOT_DIR
 
+USER root
 RUN mkdir -p /coverage/common && \
     mkdir -p /coverage/controller && \
     mkdir -p "${OW_ROOT_DIR}/common/scala/build" && \
@@ -12,4 +13,4 @@ RUN mkdir -p /coverage/common && \
     ln -s /coverage/common "${OW_ROOT_DIR}/common/scala/build/scoverage" && \
     ln -s /coverage/controller "${OW_ROOT_DIR}/core/controller/build/scoverage"
 
-COPY build/tmp/docker-coverage /controller/
\ No newline at end of file
+COPY build/tmp/docker-coverage /controller/
diff --git a/core/invoker/Dockerfile b/core/invoker/Dockerfile
index 268f24a500..ba22363af3 100644
--- a/core/invoker/Dockerfile
+++ b/core/invoker/Dockerfile
@@ -4,6 +4,8 @@
 FROM scala
 
 ENV DOCKER_VERSION 1.12.0
+ENV UID=1001 \
+    NOT_ROOT_USER=owuser
 
 RUN apk add --update openssl
 
@@ -20,6 +22,7 @@ ADD build/distributions/invoker.tar ./
 
 COPY init.sh /
 RUN chmod +x init.sh
+RUN adduser -D -u ${UID} -h /home/${NOT_ROOT_USER} -s /bin/bash ${NOT_ROOT_USER}
 
 EXPOSE 8080
 CMD ["./init.sh", "0"]


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services