{"action":"created","issue":{"url":"https://api.github.com/repos/etcd-io/etcd/issues/9955","repository_url":"https://api.github.com/repos/etcd-io/etcd","labels_url":"https://api.github.com/repos/etcd-io/etcd/issues/9955/labels{/name}","comments_url":"https://api.github.com/repos/etcd-io/etcd/issues/9955/comments","events_url":"https://api.github.com/repos/etcd-io/etcd/issues/9955/events","html_url":"https://github.com/etcd-io/etcd/issues/9955","id":343664791,"node_id":"MDU6SXNzdWUzNDM2NjQ3OTE=","number":9955,"title":"Dockerfile: run as a non-root user within the container.","user":{"login":"joelegasse","id":1391698,"node_id":"MDQ6VXNlcjEzOTE2OTg=","avatar_url":"https://avatars2.githubusercontent.com/u/1391698?v=4","gravatar_id":"","url":"https://api.github.com/users/joelegasse","html_url":"https://github.com/joelegasse","followers_url":"https://api.github.com/users/joelegasse/followers","following_url":"https://api.github.com/users/joelegasse/following{/other_user}","gists_url":"https://api.github.com/users/joelegasse/gists{/gist_id}","starred_url":"https://api.github.com/users/joelegasse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joelegasse/subscriptions","organizations_url":"https://api.github.com/users/joelegasse/orgs","repos_url":"https://api.github.com/users/joelegasse/repos","events_url":"https://api.github.com/users/joelegasse/events{/privacy}","received_events_url":"https://api.github.com/users/joelegasse/received_events","type":"User","site_admin":false},"labels":[{"id":159103993,"node_id":"MDU6TGFiZWwxNTkxMDM5OTM=","url":"https://api.github.com/repos/etcd-io/etcd/labels/Help%20Wanted","name":"Help Wanted","color":"d3f49c","default":false},{"id":848127959,"node_id":"MDU6TGFiZWw4NDgxMjc5NTk=","url":"https://api.github.com/repos/etcd-io/etcd/labels/Investigating","name":"Investigating","color":"E0E0E0","default":false},{"id":848119238,"node_id":"MDU6TGFiZWw4NDgxMTkyMzg=","url":"https://api.github.com/repos/etcd-io/etcd/labels/area/feature","name":"area/feature","color":"bafcff","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/etcd-io/etcd/milestones/36","html_url":"https://github.com/etcd-io/etcd/milestone/36","labels_url":"https://api.github.com/repos/etcd-io/etcd/milestones/36/labels","id":2696891,"node_id":"MDk6TWlsZXN0b25lMjY5Njg5MQ==","number":36,"title":"etcd-v3.4","description":"","creator":{"login":"gyuho","id":6799218,"node_id":"MDQ6VXNlcjY3OTkyMTg=","avatar_url":"https://avatars0.githubusercontent.com/u/6799218?v=4","gravatar_id":"","url":"https://api.github.com/users/gyuho","html_url":"https://github.com/gyuho","followers_url":"https://api.github.com/users/gyuho/followers","following_url":"https://api.github.com/users/gyuho/following{/other_user}","gists_url":"https://api.github.com/users/gyuho/gists{/gist_id}","starred_url":"https://api.github.com/users/gyuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gyuho/subscriptions","organizations_url":"https://api.github.com/users/gyuho/orgs","repos_url":"https://api.github.com/users/gyuho/repos","events_url":"https://api.github.com/users/gyuho/events{/privacy}","received_events_url":"https://api.github.com/users/gyuho/received_events","type":"User","site_admin":false},"open_issues":53,"closed_issues":72,"state":"open","created_at":"2017-08-11T17:16:06Z","updated_at":"2019-06-09T02:51:21Z","due_on":null,"closed_at":null},"comments":7,"created_at":"2018-07-23T14:46:53Z","updated_at":"2019-07-05T15:29:05Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"There has been some renewed interest in #3503, from almost 3 years ago. The idea being that the user ID within the container should not be root (uid 0). There have been some changes to container runtimes since then, including wider support for user namespaces that allow mapping user IDs within a container to non-privileged user IDs on the host.\r\n\r\nThe primary concern of just issuing `USER XYZ` in the Dockerfile, or even trying to be clever with adjusting permissions before dropping privileges would be the upgrade path for users already managing the user ID or permissions with currently available features of the runtime. Some examples being:\r\n\r\n- User ID specified at the time the container is created/started.\r\n  - Might cause issues if root is assumed in an attempt to drop privileges.\r\n- Various config options (ENV, config file, command args) used to change data storage locations\r\n  - Adjusting underlying permissions would require full resolution of final etcd config before locations could be known and permissions updated\r\n- Shared volumes with other containers\r\n  - Adjusting permissions via the etcd container could break setups where volumes are shared with other containers.\r\n\r\nIf we go down the \"adjust permissions before startup\" road, we'd have to either change the entry point to a custom script or integrate the permissions check into the `etcd` code directly. The latter isn't very helpful for non-container usage and a custom script would need to figure out where the final data locations would be before adjusting any permissions. Simply adding `USER xyz` to the Dockerfile would almost certainly break existing containers without a manual intervention to update the permissions within the volume.\r\n\r\nThis issue should be a discussion about the trade-offs and implications of each option. I'm personally leaning toward just adding a recommendation that a non-root user be used when creating the container. I think there are too many unknowns about how the image is being used to try to change this behavior at this point. Any change is likely to break some user's setup, and we should acknowledge where those breakages might occur, or what overhead we're adding to the upgrade process before we proceed with a PR to change the default user ID in the container image."},"comment":{"url":"https://api.github.com/repos/etcd-io/etcd/issues/comments/508794682","html_url":"https://github.com/etcd-io/etcd/issues/9955#issuecomment-508794682","issue_url":"https://api.github.com/repos/etcd-io/etcd/issues/9955","id":508794682,"node_id":"MDEyOklzc3VlQ29tbWVudDUwODc5NDY4Mg==","user":{"login":"pantaoran","id":7800702,"node_id":"MDQ6VXNlcjc4MDA3MDI=","avatar_url":"https://avatars2.githubusercontent.com/u/7800702?v=4","gravatar_id":"","url":"https://api.github.com/users/pantaoran","html_url":"https://github.com/pantaoran","followers_url":"https://api.github.com/users/pantaoran/followers","following_url":"https://api.github.com/users/pantaoran/following{/other_user}","gists_url":"https://api.github.com/users/pantaoran/gists{/gist_id}","starred_url":"https://api.github.com/users/pantaoran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pantaoran/subscriptions","organizations_url":"https://api.github.com/users/pantaoran/orgs","repos_url":"https://api.github.com/users/pantaoran/repos","events_url":"https://api.github.com/users/pantaoran/events{/privacy}","received_events_url":"https://api.github.com/users/pantaoran/received_events","type":"User","site_admin":false},"created_at":"2019-07-05T15:29:05Z","updated_at":"2019-07-05T15:29:05Z","author_association":"NONE","body":"Ha, I had no idea. Looks like I'm the fool here!\r\nThank you very much!\r\n\r\nI haven't tried this method with your image because I already found an alternative image from bitnami that uses a non-root user in the Dockerfile. There are of course still questions about if everything would really work as a non-root user at runtime, but I will not have time to try that in this case. Good luck everyone :-)"}}
{"actor":{"display_login":"pantaoran"}}