Skip to content

Stop using root in container-scanning analyzer

Sashi Kumar Kumaresan requested to merge sk/273530-stop-root into master

This MR changes the user from root to a non-root user in the container.

Related to gitlab-org/gitlab#273530 (closed).

  • Add non root user gitlab to the container
  • ADDITIONAL_CA_CERT_BUNDLE content gets written to /usr/local/share/ca-certificates/custom.crt and copied to /usr/lib/ssl/certs/ which a non-root user would not have permission to read/write. It has to be changed to a directory that the non-root user has permission to read/write.
  • /script/setup_integration installs few dependencies for bootstrapping the test environment. Since it uses apt-get, it has to be run in sudo mode.
  • WORKDIR points to the root directory which a non-root user would not have permission to read/write. It has to be changed to a directory (/home/gitlab) that the non-root user have permission to read/write.

Testing

This MR is tested against branch root-master-patch-33546 in the OpenShift environment. These cases are covered with sk-273530-stop-root image from the registry:

Edited by Sashi Kumar Kumaresan

Merge request reports