Skip to content

Commit 2f50f92

Browse files
acosta11acosta11
committed
Conditionally use 'vcap' as default docker user
* Now that user may be overridden on processes and tasks, update default user based on new flag to allow or deny the use of 'root'.
1 parent e9ffa3e commit 2f50f92

File tree

5 files changed

+194
-63
lines changed

5 files changed

+194
-63
lines changed

‎app/models/runtime/droplet_model.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ def docker_user
138138
end
139139
end
140140

141-
container_user.presence || AppModel::DEFAULT_DOCKER_CONTAINER_USER
141+
container_user.presence || (Config.config.get(:allow_process_root_user) ? AppModel::DEFAULT_DOCKER_CONTAINER_USER : AppModel::DEFAULT_CONTAINER_USER)
142142
end
143143

144144
def staging?

‎app/models/runtime/process_model.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -578,7 +578,7 @@ def permitted_users
578578
def docker_run_action_user
579579
return AppModel::DEFAULT_CONTAINER_USER unless docker?
580580

581-
desired_droplet&.docker_user.presence || AppModel::DEFAULT_DOCKER_CONTAINER_USER
581+
desired_droplet&.docker_user.presence || (Config.config.get(:allow_process_root_user) ? AppModel::DEFAULT_DOCKER_CONTAINER_USER : AppModel::DEFAULT_CONTAINER_USER)
582582
end
583583

584584
def non_unique_process_types

‎app/models/runtime/task_model.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ def permitted_users
6666
end
6767

6868
def docker_run_action_user
69-
droplet.docker_user.presence || AppModel::DEFAULT_CONTAINER_USER
69+
droplet&.docker_user.presence || (Config.config.get(:allow_process_root_user) ? AppModel::DEFAULT_DOCKER_CONTAINER_USER : AppModel::DEFAULT_CONTAINER_USER)
7070
end
7171

7272
def running_state?

‎spec/unit/models/runtime/process_model_spec.rb

Lines changed: 104 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -687,62 +687,133 @@ def act_as_cf_admin
687687
process.desired_droplet.reload
688688
end
689689

690-
context 'when the process has a user specified' do
690+
context 'when root user is allowed' do
691691
before do
692-
process.update(user: 'ContainerUser')
692+
TestConfig.override(allow_process_root_user: true)
693693
end
694694

695-
it 'returns the user' do
696-
expect(process.run_action_user).to eq('ContainerUser')
695+
context 'when the process has a user specified' do
696+
before do
697+
process.update(user: 'ContainerUser')
698+
end
699+
700+
it 'returns the user' do
701+
expect(process.run_action_user).to eq('ContainerUser')
702+
end
697703
end
698-
end
699704

700-
context 'when the droplet execution metadata specifies a user' do
701-
it 'returns the specified user' do
702-
expect(process.run_action_user).to eq('some-user')
705+
context 'when the droplet execution metadata specifies a user' do
706+
it 'returns the specified user' do
707+
expect(process.run_action_user).to eq('some-user')
708+
end
703709
end
704-
end
705710

706-
context 'when the droplet execution metadata DOES NOT specify a user' do
707-
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
711+
context 'when the droplet execution metadata DOES NOT specify a user' do
712+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
708713

709-
it 'defaults the user to root' do
710-
expect(process.run_action_user).to eq('root')
714+
it 'returns the default "root" user' do
715+
expect(process.run_action_user).to eq('root')
716+
end
711717
end
712-
end
713718

714-
context 'when the droplet execution metadata is an empty string' do
715-
let(:droplet_execution_metadata) { '' }
719+
context 'when the droplet execution metadata is an empty string' do
720+
let(:droplet_execution_metadata) { '' }
721+
722+
it 'returns the default "root" user' do
723+
expect(process.run_action_user).to eq('root')
724+
end
725+
end
716726

717-
it 'defaults the user to root' do
718-
expect(process.run_action_user).to eq('root')
727+
context 'when the droplet execution metadata is nil' do
728+
let(:droplet_execution_metadata) { nil }
729+
730+
it 'returns the default "root" user' do
731+
expect(process.run_action_user).to eq('root')
732+
end
719733
end
720-
end
721734

722-
context 'when the droplet execution metadata is nil' do
723-
let(:droplet_execution_metadata) { nil }
735+
context 'when the droplet execution metadata has invalid json' do
736+
let(:droplet_execution_metadata) { '{' }
724737

725-
it 'defaults the user to root' do
726-
expect(process.run_action_user).to eq('root')
738+
it 'returns the default "root" user' do
739+
expect(process.run_action_user).to eq('root')
740+
end
727741
end
728-
end
729742

730-
context 'when the droplet execution metadata has invalid json' do
731-
let(:droplet_execution_metadata) { '{' }
743+
context 'when the app does not have a droplet assigned' do
744+
before do
745+
process.app.update(droplet: nil)
746+
process.reload
747+
end
732748

733-
it 'defaults the user to root' do
734-
expect(process.run_action_user).to eq('root')
749+
it 'returns the default "root" user' do
750+
expect(process.run_action_user).to eq('root')
751+
end
735752
end
736753
end
737754

738-
context 'when the app does not have a droplet assigned' do
755+
context 'when root user is not allowed' do
739756
before do
740-
process.app.update(droplet: nil)
741-
process.reload
757+
TestConfig.override(allow_process_root_user: false)
758+
end
759+
760+
context 'when the process has a user specified' do
761+
before do
762+
process.update(user: 'ContainerUser')
763+
end
764+
765+
it 'returns the user' do
766+
expect(process.run_action_user).to eq('ContainerUser')
767+
end
768+
end
769+
770+
context 'when the droplet execution metadata specifies a user' do
771+
it 'returns the specified user' do
772+
expect(process.run_action_user).to eq('some-user')
773+
end
774+
end
775+
776+
context 'when the droplet execution metadata DOES NOT specify a user' do
777+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
778+
779+
it 'returns the default "vcap" user' do
780+
expect(process.run_action_user).to eq('vcap')
781+
end
782+
end
783+
784+
context 'when the droplet execution metadata is an empty string' do
785+
let(:droplet_execution_metadata) { '' }
786+
787+
it 'returns the default "vcap" user' do
788+
expect(process.run_action_user).to eq('vcap')
789+
end
790+
end
791+
792+
context 'when the droplet execution metadata is nil' do
793+
let(:droplet_execution_metadata) { nil }
794+
795+
it 'returns the default "vcap" user' do
796+
expect(process.run_action_user).to eq('vcap')
797+
end
798+
end
799+
800+
context 'when the droplet execution metadata has invalid json' do
801+
let(:droplet_execution_metadata) { '{' }
802+
803+
it 'returns the default "vcap" user' do
804+
expect(process.run_action_user).to eq('vcap')
805+
end
742806
end
743807

744-
it 'defaults the user to root' do
745-
expect(process.run_action_user).to eq('root')
808+
context 'when the app does not have a droplet assigned' do
809+
before do
810+
process.app.update(droplet: nil)
811+
process.reload
812+
end
813+
814+
it 'returns the default "vcap" user' do
815+
expect(process.run_action_user).to eq('vcap')
816+
end
746817
end
747818
end
748819
end

‎spec/unit/models/runtime/task_model_spec.rb

Lines changed: 87 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -204,51 +204,111 @@ module VCAP::CloudController
204204
task.droplet.update(execution_metadata: droplet_execution_metadata)
205205
end
206206

207-
context 'when the task has a user specified' do
207+
context 'when root user is allowed' do
208208
before do
209-
task.update(user: 'ContainerUser')
209+
TestConfig.override(allow_process_root_user: true)
210210
end
211211

212-
it 'returns the user' do
213-
expect(task.run_action_user).to eq('ContainerUser')
212+
context 'when the task has a user specified' do
213+
before do
214+
task.update(user: 'ContainerUser')
215+
end
216+
217+
it 'returns the user' do
218+
expect(task.run_action_user).to eq('ContainerUser')
219+
end
214220
end
215-
end
216221

217-
context 'when the droplet execution metadata specifies a user' do
218-
it 'returns the specified user' do
219-
expect(task.run_action_user).to eq('cnb')
222+
context 'when the droplet execution metadata specifies a user' do
223+
it 'returns the specified user' do
224+
expect(task.run_action_user).to eq('cnb')
225+
end
220226
end
221-
end
222227

223-
context 'when the droplet execution metadata DOES NOT specify a user' do
224-
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
228+
context 'when the droplet execution metadata DOES NOT specify a user' do
229+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
225230

226-
it 'defaults the user to root' do
227-
expect(task.run_action_user).to eq('root')
231+
it 'defaults the user to root' do
232+
expect(task.run_action_user).to eq('root')
233+
end
228234
end
229-
end
230235

231-
context 'when the droplet execution metadata is an empty string' do
232-
let(:droplet_execution_metadata) { '' }
236+
context 'when the droplet execution metadata is an empty string' do
237+
let(:droplet_execution_metadata) { '' }
233238

234-
it 'defaults the user to root' do
235-
expect(task.run_action_user).to eq('root')
239+
it 'defaults the user to root' do
240+
expect(task.run_action_user).to eq('root')
241+
end
236242
end
237-
end
238243

239-
context 'when the droplet execution metadata is nil' do
240-
let(:droplet_execution_metadata) { nil }
244+
context 'when the droplet execution metadata is nil' do
245+
let(:droplet_execution_metadata) { nil }
241246

242-
it 'defaults the user to root' do
243-
expect(task.run_action_user).to eq('root')
247+
it 'defaults the user to root' do
248+
expect(task.run_action_user).to eq('root')
249+
end
250+
end
251+
252+
context 'when the droplet execution metadata has invalid json' do
253+
let(:droplet_execution_metadata) { '{' }
254+
255+
it 'defaults the user to root' do
256+
expect(task.run_action_user).to eq('root')
257+
end
244258
end
245259
end
246260

247-
context 'when the droplet execution metadata has invalid json' do
248-
let(:droplet_execution_metadata) { '{' }
261+
context 'when root user is not allowed' do
262+
before do
263+
TestConfig.override(allow_process_root_user: false)
264+
end
249265

250-
it 'defaults the user to root' do
251-
expect(task.run_action_user).to eq('root')
266+
context 'when the task has a user specified' do
267+
before do
268+
task.update(user: 'ContainerUser')
269+
end
270+
271+
it 'returns the user' do
272+
expect(task.run_action_user).to eq('ContainerUser')
273+
end
274+
end
275+
276+
context 'when the droplet execution metadata specifies a user' do
277+
it 'returns the specified user' do
278+
expect(task.run_action_user).to eq('cnb')
279+
end
280+
end
281+
282+
context 'when the droplet execution metadata DOES NOT specify a user' do
283+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
284+
285+
it 'defaults the user to vcap' do
286+
expect(task.run_action_user).to eq('vcap')
287+
end
288+
end
289+
290+
context 'when the droplet execution metadata is an empty string' do
291+
let(:droplet_execution_metadata) { '' }
292+
293+
it 'defaults the user to vcap' do
294+
expect(task.run_action_user).to eq('vcap')
295+
end
296+
end
297+
298+
context 'when the droplet execution metadata is nil' do
299+
let(:droplet_execution_metadata) { nil }
300+
301+
it 'defaults the user to vcap' do
302+
expect(task.run_action_user).to eq('vcap')
303+
end
304+
end
305+
306+
context 'when the droplet execution metadata has invalid json' do
307+
let(:droplet_execution_metadata) { '{' }
308+
309+
it 'defaults the user to vcap' do
310+
expect(task.run_action_user).to eq('vcap')
311+
end
252312
end
253313
end
254314
end

0 commit comments

Comments
 (0)