grafana-bridge should run with a non root user in a container

Author: Helene

Dockerfile

@@ -13,11 +13,14 @@ RUN echo "Installed python packages: $(/usr/bin/pip3 list)"
 USER root
 
 RUN mkdir -p /opt/IBM/bridge
-COPY ./source/ /opt/IBM/bridge
-COPY LICENSE /opt/IBM/bridge
-
-RUN mkdir -p /var/mmfs/gen
 RUN mkdir -p /opt/IBM/zimon
+RUN mkdir -p /var/mmfs/gen
+RUN mkdir -p /etc/ssl/certs
+RUN mkdir -p /etc/perfmon-api-keys
+
+COPY LICENSE /licenses/
+
+COPY ./source/ /opt/IBM/bridge
 COPY ./source/gpfsConfig/mmsdrfs* /var/mmfs/gen/
 COPY ./source/gpfsConfig/ZIMon* /opt/IBM/zimon/
 
@@ -33,8 +36,9 @@ ARG PERFMONPORT=9980
 ENV SERVERPORT=$PERFMONPORT
 RUN echo "the PERFMONPORT port is set to $SERVERPORT" 
 
-ARG CERTPATH=None
+ARG CERTPATH='/etc/bridge_ssl/certs'
 ENV TLSKEYPATH=$CERTPATH
+RUN mkdir -p $CERTPATH
 
 ARG KEYFILE=None
 ENV TLSKEYFILE=$KEYFILE
@@ -47,6 +51,7 @@ ENV APIKEYNAME=$KEYNAME
 
 ARG KEYVALUE=None
 ENV APIKEYVALUE=$KEYVALUE
+RUN if [ "${APIKEYVALUE:0:1}" = "/" ]; then ln -s $APIKEYVALUE /etc/perfmon-api-keys; echo "APIKEYVALUE is a PATH"; else echo "APIKEYVALUE not a PATH"; fi
 
 RUN if [ -z "$TLSKEYPATH" ] || [ -z "$TLSCERTFILE" ] || [ -z "$TLSKEYFILE" ] && [ "$PROTOCOL" = "https" ]; then echo "TLSKEYPATH FOR SSL CONNECTION NOT SET - ERROR"; exit 1; else echo "PASS"; fi
 RUN echo "the ssl certificates path is set to $TLSKEYPATH" 
@@ -55,23 +60,38 @@ ARG PMCOLLECTORIP=0.0.0.0
 ENV SERVER=$PMCOLLECTORIP
 RUN echo "the pmcollector server ip is set to $SERVER"
 
+ARG DEFAULTLOGPATH='/var/log/ibm_bridge_for_grafana'
+ENV LOGPATH=$DEFAULTLOGPATH
+RUN mkdir -p $LOGPATH
+RUN echo "the log will use $LOGPATH"
 
 WORKDIR /opt/IBM/bridge
-
-ARG DEFAULTLOGPATH='/var/log/ibm_bridge_for_grafana/install.log'
-ENV LOGPATH=$DEFAULTLOGPATH
-RUN mkdir -p $(dirname $LOGPATH)
-RUN echo "the log will use $(dirname $LOGPATH)"
 RUN echo "$(pwd)"
 
-RUN touch $LOGPATH
-RUN echo "log path: $(dirname $LOGPATH)" >> $LOGPATH
-RUN echo "pmcollector_server: $SERVER" >> $LOGPATH
-RUN echo "ssl certificates location: $TLSKEYPATH" >> $LOGPATH
-RUN echo "HTTP/S port: $PORT" >> $LOGPATH
+RUN touch "${LOGPATH}/install.log"
+RUN echo "log path: $LOGPATH" >> ${LOGPATH}/install.log
+RUN echo "pmcollector_server: $SERVER" >> ${LOGPATH}/install.log
+RUN echo "ssl certificates location: $TLSKEYPATH" >> ${LOGPATH}/install.log
+RUN echo "HTTP/S port: $PORT" >> ${LOGPATH}/install.log
+
+# Create a user 'bridge' under 'root' group
+RUN groupadd -g 2099 bridge
+RUN useradd -rm -d /home/2001 -s /bin/bash -g 2099 -u 2001 bridge
+
+# Chown all the files to the grafanabridge 'bridge' user.
+RUN chown -R 2001:2099 /opt/IBM/bridge
+RUN chown -R 2001:2099 /opt/IBM/zimon
+RUN chown -R 2001:2099 /var/mmfs/gen
+RUN chown -R 2001:2099 /etc/ssl/certs
+RUN chown -R 2001:2099 /etc/perfmon-api-keys
+RUN chown -R 2001:2099 $TLSKEYPATH
+RUN chown -R 2001:2099 $LOGPATH
+
+# Switch to user 'bridge'
+USER 2001
 
 
-CMD ["sh", "-c", "python3 zimonGrafanaIntf.py -c 10 -s $SERVER -r $PROTOCOL -p $PORT -P $SERVERPORT -t $TLSKEYPATH --tlsKeyFile $TLSKEYFILE --tlsCertFile $TLSCERTFILE --apiKeyName $APIKEYNAME --apiKeyValue $APIKEYVALUE"]
+CMD ["sh", "-c", "python3 zimonGrafanaIntf.py -c 10 -s $SERVER -r $PROTOCOL -p $PORT -P $SERVERPORT -t $TLSKEYPATH -l $LOGPATH --tlsKeyFile $TLSKEYFILE --tlsCertFile $TLSCERTFILE --apiKeyName $APIKEYNAME --apiKeyValue $APIKEYVALUE"]
 
 EXPOSE 4242 8443