[I] [Docker] Runtime images run as root, no HEALTHCHECK, locale/ENV hygiene (eventmesh)

["qqeasonchen (via GitHub)" <gi...@apache.org>]

qqeasonchen opened a new issue, #5350:
URL: https://github.com/apache/eventmesh/issues/5350

   ## Summary
   
   A review of `docker/Dockerfile` and `docker/Dockerfile.connector` (both shipped to Docker Hub via `.github/workflows/docker.yml` on every release) found two P0 container-safety gaps and several P1/P2 issues. This issue tracks the fixes.
   
   ## P0 — security / operability
   
   ### 1. Runtime containers run as root
   
   Neither Dockerfile creates a non-root user or uses `--chown` on the `COPY --from=builder` step. The published `apache/eventmesh` and `apache/eventmesh-connector` images therefore run the JVM as **root**:
   
   - flagged as a high-severity finding by every image scanner (trivy / docker-scout),
   - violates the Apache/container best practice and most deployment policies (K8s `runAsNonRoot`, OpenShift SCC),
   - when operators mount volumes, files written by the process (RocksDB offsets under `data/`, logs) land as root-owned on the host.
   
   ### 2. No HEALTHCHECK
   
   The runtime exposes a dedicated liveness endpoint (`GET /admin/health` on the admin port, wired in `UniAdminServer`), but the image declares no `HEALTHCHECK`, so `docker run` / compose / swarm users get no health signal. K8s users must reinvent the probe.
   
   ## P1 — correctness / hygiene
   
   ### 3. `locales` package installed but never selected
   
   Both images `apt-get install locales`, run `localedef -i en_US -f UTF-8`, but never set `ENV LANG`/`LC_ALL`. The generated locale is therefore unused — the JVM still runs under `POSIX`. `eclipse-temurin:21-jre` already ships `C.UTF-8`, so the whole `locales`+`localedef` dance can be dropped in favor of `ENV LANG=C.UTF-8 LC_ALL=C.UTF-8` (one less package, smaller layer).
   
   ### 4. `COPY --from=builder` without `--chown`
   
   Even after adding a non-root user, `COPY --from=builder /build/dist ./` would leave the tree root-owned. Needs `--chown`.
   
   ### 5. No VOLUME for persistent state
   
   The RocksDB offset path (`/data/app/eventmesh/data/offset`, `EVENTMESH_OFFSET_PATH`) is the at-least-once delivery progress. Without a `VOLUME` declaration, an operator who forgets to mount silently loses offsets when the container is removed. Declare the `data/` directory as a VOLUME so the intent is visible and anonymous volumes back the default path.
   
   ### 6. EXPOSE comment doesn't mention A2A
   
   The runtime image documents ports 8080/8081/8082 but says nothing about the A2A Gateway (experimental, `A2AGatewayServer`, not wired into `EventMeshApplication.main` by default). Operators reading the Dockerfile should know it exists, is EXPERIMENTAL, and is not started by `bin/start.sh` today.
   
   ## P2 — recorded, not fixed here
   
   - **Dead ENV**: `EVENTMESH_LOG_HOME` / `CONFPATH` are set but no code path in `eventmesh-runtime` reads them (grep: zero consumers). Kept as a volume-mount convention; harmless.
   - **JVM memory guidance**: `JAVA_OPTS` defaults to empty; docs could suggest `-XX:MaxRAMPercentage=70` for container limits. Doc-level, not Dockerfile.
   - **`RUN chmod +x bin/*.sh`** may be redundant with the gradle dist task's file modes; harmless, kept.
   
   ## Fix plan (one PR)
   
   For **both** images:
   
   - drop `locales` + `localedef`, add `ENV LANG=C.UTF-8 LC_ALL=C.UTF-8` (keep `procps`; keep `findutils` in the connector image — `start-connector.sh` needs `find`)
   - create a dedicated non-root user (`eventmesh` uid 10001 / `connector` uid 10002, nologin)
   - `COPY --from=builder --chown=<user>:<group>`
   - `USER <user>` before `CMD`
   
   For the **runtime** image:
   
   - `HEALTHCHECK` via `bash /dev/tcp` against `127.0.0.1:${EVENTMESH_ADMIN_PORT:-8081}` `GET /admin/health` expecting `200` (no curl/wget added; `/dev/tcp` is enabled in Debian/Ubuntu bash)
   - `VOLUME ["/data/app/eventmesh/data"]`
   - EXPOSE comment notes the A2A gateway is experimental and not started by default
   
   For the **connector** image:
   
   - `HEALTHCHECK` via `pgrep -f ConnectorApplication` (process-level; the admin port defaults to 0/off, so an HTTP probe would false-negative for the default config; HTTP-level check can follow once the admin API grows a documented health route)
   - `VOLUME ["/data/app/connector/data"]`
   
   ## Acceptance
   
   - [ ] Neither image runs as root (`docker run --rm ... id -u` returns non-zero uid)
   - [ ] `docker inspect` shows a HEALTHCHECK on both images
   - [ ] Runtime healthcheck returns healthy against `/admin/health` on a live container
   - [ ] `locales` package absent from both runtime stages; `LANG=C.UTF-8` set
   - [ ] `data/` declared as VOLUME in both images
   - [ ] Images still build (`gradle clean dist` + `installPlugin` / `dist-connector` unchanged)
   
   ## Out of scope
   
   - Wiring `A2AGatewayServer` into `EventMeshApplication.main` (product decision, tracked separately)
   - Builder-stage hardening (runs as root in `gradle:8.5.0-jdk21`; build-time-only, no shipped artifact impact)
   - CI docker build job (currently blocked by the repo-wide Actions outage, same as all ubuntu-latest workflows)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: issues-help@eventmesh.apache.org

Re: [I] [Docker] Runtime images run as root, no HEALTHCHECK, locale/ENV hygiene (eventmesh)

["qqeasonchen (via GitHub)" <gi...@apache.org>]

qqeasonchen closed issue #5350: [Docker] Runtime images run as root, no HEALTHCHECK, locale/ENV hygiene
URL: https://github.com/apache/eventmesh/issues/5350


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: issues-help@eventmesh.apache.org