{"action":"opened","issue":{"url":"https://api.github.com/repos/ray-project/ray/issues/2634","repository_url":"https://api.github.com/repos/ray-project/ray","labels_url":"https://api.github.com/repos/ray-project/ray/issues/2634/labels{/name}","comments_url":"https://api.github.com/repos/ray-project/ray/issues/2634/comments","events_url":"https://api.github.com/repos/ray-project/ray/issues/2634/events","html_url":"https://github.com/ray-project/ray/issues/2634","id":349627323,"node_id":"MDU6SXNzdWUzNDk2MjczMjM=","number":2634,"title":"Run Ray workers as non-root user","user":{"login":"mitar","id":585279,"node_id":"MDQ6VXNlcjU4NTI3OQ==","avatar_url":"https://avatars3.githubusercontent.com/u/585279?v=4","gravatar_id":"","url":"https://api.github.com/users/mitar","html_url":"https://github.com/mitar","followers_url":"https://api.github.com/users/mitar/followers","following_url":"https://api.github.com/users/mitar/following{/other_user}","gists_url":"https://api.github.com/users/mitar/gists{/gist_id}","starred_url":"https://api.github.com/users/mitar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitar/subscriptions","organizations_url":"https://api.github.com/users/mitar/orgs","repos_url":"https://api.github.com/users/mitar/repos","events_url":"https://api.github.com/users/mitar/events{/privacy}","received_events_url":"https://api.github.com/users/mitar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-10T19:12:34Z","updated_at":"2018-08-10T19:12:34Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I have not seen much documentation about that, but I would prefer if our workers would run as a non-root user. It seems there is no way to run only workers as non-root.\r\n\r\nI will have yet to test if one can run while `ray start` as non-root and how this works. But ideally, other processes should not run with the same user as worker, and none should have to run as root.\r\n\r\nMy motivation here is mostly to have better computerization of processes. Root really has a lot of permissions and I would prefer to make more predictable what bugs can do. For example, root can fill whole disk space while regular user cannot fill the reserve space.\r\n\r\nI know that Ray is not designed to be secure execution platform for untrusted code, but having process separation is a good technique anyway."}}
{"actor":{"display_login":"mitar"}}