{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/85","repository_url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/85/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/85/events","html_url":"https://github.com/GoogleCloudPlatform/python-compat-runtime/issues/85","id":150697614,"number":85,"title":"SEC: app should not run as root","user":{"login":"westurner","id":50891,"avatar_url":"https://avatars.githubusercontent.com/u/50891?v=3","gravatar_id":"","url":"https://api.github.com/users/westurner","html_url":"https://github.com/westurner","followers_url":"https://api.github.com/users/westurner/followers","following_url":"https://api.github.com/users/westurner/following{/other_user}","gists_url":"https://api.github.com/users/westurner/gists{/gist_id}","starred_url":"https://api.github.com/users/westurner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/westurner/subscriptions","organizations_url":"https://api.github.com/users/westurner/orgs","repos_url":"https://api.github.com/users/westurner/repos","events_url":"https://api.github.com/users/westurner/events{/privacy}","received_events_url":"https://api.github.com/users/westurner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-24T20:45:12Z","updated_at":"2016-04-24T20:48:51Z","closed_at":null,"body":"[gunicorn, app abc] should not be run as root (even in a container).\r\n\r\n* https://en.wikipedia.org/wiki/Principle_of_least_privilege\r\n* :CWE-250: Execution with Unnecessary Privileges\" https://cwe.mitre.org/data/definitions/250.html\r\n\r\nFrom https://docs.docker.com/engine/security/security/ :\r\n\r\n> \"Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e., non-root).\"\r\n\r\nYou can fix this by adding the following line before running the process that requires sockets above 1024:\r\n\r\n```\r\nUSER nonroot\r\n```\r\n\r\n* https://github.com/schemaorg/schemaorg/pull/1007/files#diff-d3d258ac6e0a80b1915a394d2ace3393R43"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/comments/214032688","html_url":"https://github.com/GoogleCloudPlatform/python-compat-runtime/issues/85#issuecomment-214032688","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/python-compat-runtime/issues/85","id":214032688,"user":{"login":"westurner","id":50891,"avatar_url":"https://avatars.githubusercontent.com/u/50891?v=3","gravatar_id":"","url":"https://api.github.com/users/westurner","html_url":"https://github.com/westurner","followers_url":"https://api.github.com/users/westurner/followers","following_url":"https://api.github.com/users/westurner/following{/other_user}","gists_url":"https://api.github.com/users/westurner/gists{/gist_id}","starred_url":"https://api.github.com/users/westurner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/westurner/subscriptions","organizations_url":"https://api.github.com/users/westurner/orgs","repos_url":"https://api.github.com/users/westurner/repos","events_url":"https://api.github.com/users/westurner/events{/privacy}","received_events_url":"https://api.github.com/users/westurner/received_events","type":"User","site_admin":false},"created_at":"2016-04-24T20:48:51Z","updated_at":"2016-04-24T20:48:51Z","body":"(I would've just ``EXTEND``-ed from this container if I had been aware of it.)\r\n\r\nAre there any plans to offer e.g. a CentOS version w/ selinux support?"}}