{"action":"created","issue":{"url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/3579","repository_url":"https://api.github.com/repos/apache/incubator-openwhisk","labels_url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/3579/labels{/name}","comments_url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/3579/comments","events_url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/3579/events","html_url":"https://github.com/apache/incubator-openwhisk/pull/3579","id":317611972,"number":3579,"title":"Using non root user in controller","user":{"login":"Himavanth","id":3353114,"avatar_url":"https://avatars0.githubusercontent.com/u/3353114?v=4","gravatar_id":"","url":"https://api.github.com/users/Himavanth","html_url":"https://github.com/Himavanth","followers_url":"https://api.github.com/users/Himavanth/followers","following_url":"https://api.github.com/users/Himavanth/following{/other_user}","gists_url":"https://api.github.com/users/Himavanth/gists{/gist_id}","starred_url":"https://api.github.com/users/Himavanth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Himavanth/subscriptions","organizations_url":"https://api.github.com/users/Himavanth/orgs","repos_url":"https://api.github.com/users/Himavanth/repos","events_url":"https://api.github.com/users/Himavanth/events{/privacy}","received_events_url":"https://api.github.com/users/Himavanth/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-04-25T12:44:44Z","updated_at":"2018-05-24T12:26:41Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/apache/incubator-openwhisk/pulls/3579","html_url":"https://github.com/apache/incubator-openwhisk/pull/3579","diff_url":"https://github.com/apache/incubator-openwhisk/pull/3579.diff","patch_url":"https://github.com/apache/incubator-openwhisk/pull/3579.patch"},"body":"Using a different user than root would be helpful in mitigating security risks that could arise because of root privileges.\r\nHave done some basic testing.\r\nWould like some feedback.\r\n\r\n## Related issue and scope\r\n\r\n## My changes affect the following components\r\n<!--- Select below all system components are affected by your change. -->\r\n<!--- Enter an `x` in all applicable boxes. -->\r\n- [ ] API\r\n- [ x] Controller\r\n- [ ] Message Bus (e.g., Kafka)\r\n- [ ] Loadbalancer\r\n- [ ] Invoker\r\n- [ ] Intrinsic actions (e.g., sequences, conductors)\r\n- [ ] Data stores (e.g., CouchDB)\r\n- [ ] Tests\r\n- [ ] Deployment\r\n- [ ] CLI\r\n- [ ] General tooling\r\n- [ ] Documentation\r\n\r\n## Types of changes\r\n- [ ] Bug fix (generally a non-breaking change which closes an issue).\r\n- [ ] Enhancement or new feature (adds new functionality).\r\n- [x ] Breaking change (a bug fix or enhancement which changes existing behavior).\r\n\r\n## Checklist:\r\n- [ x] I signed an [Apache CLA](https://github.com/apache/incubator-openwhisk/blob/master/CONTRIBUTING.md).\r\n- [ ] I reviewed the [style guides](https://github.com/apache/incubator-openwhisk/wiki/Contributing:-Git-guidelines#code-readiness) and followed the recommendations (Travis CI will check :).\r\n- [ ] I added tests to cover my changes.\r\n- [ ] My changes require further changes to the documentation.\r\n- [ ] I updated the documentation where necessary.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/comments/391695352","html_url":"https://github.com/apache/incubator-openwhisk/pull/3579#issuecomment-391695352","issue_url":"https://api.github.com/repos/apache/incubator-openwhisk/issues/3579","id":391695352,"user":{"login":"fmaschler","id":5763512,"avatar_url":"https://avatars3.githubusercontent.com/u/5763512?v=4","gravatar_id":"","url":"https://api.github.com/users/fmaschler","html_url":"https://github.com/fmaschler","followers_url":"https://api.github.com/users/fmaschler/followers","following_url":"https://api.github.com/users/fmaschler/following{/other_user}","gists_url":"https://api.github.com/users/fmaschler/gists{/gist_id}","starred_url":"https://api.github.com/users/fmaschler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fmaschler/subscriptions","organizations_url":"https://api.github.com/users/fmaschler/orgs","repos_url":"https://api.github.com/users/fmaschler/repos","events_url":"https://api.github.com/users/fmaschler/events{/privacy}","received_events_url":"https://api.github.com/users/fmaschler/received_events","type":"User","site_admin":false},"created_at":"2018-05-24T12:26:41Z","updated_at":"2018-05-24T12:26:41Z","author_association":"NONE","body":"This is good when you talk about INSIDE containers but this is about the OUTSIDE: The containers process on the host runs as root.\r\n> The best way to prevent privilege-escalation attacks from within a container is to configure your container’s applications to run as unprivileged users. For containers whose processes must run as the root user within the container, you can re-map this user to a less-privileged user on the Docker host.\r\n\r\nThe question is if controller, kafka, invoker and the runtime containers all need to run as root?"}}
{"actor":{"display_login":"fmaschler"}}