Disallow Process and Task 'root' user at runtime

* Allow 'root' user in droplet docker execution metadata via dockerfile
  for staging because user may be subsequently overridden on Process or
  Task model
* Enforce that 'root' user is not used at runtime by task_action and
  desired_lrp builders

Author: acosta11

lib/cloud_controller/diego/docker/lifecycle_protocol.rb

@@ -22,10 +22,18 @@ def staging_action_builder(config, staging_details)
           end
 
           def task_action_builder(config, task)
+            if task.run_action_user == 'root' && !Config.config.get(:allow_docker_root_user)
+              raise ::CloudController::Errors::ApiError.new_from_details('RunnerError', "'root' user not permitted.")
+            end
+
             TaskActionBuilder.new(config, task, { droplet_path: task.droplet.docker_receipt_image })
           end
 
           def desired_lrp_builder(config, process)
+            if process.run_action_user == 'root' && !Config.config.get(:allow_docker_root_user)
+              raise ::CloudController::Errors::ApiError.new_from_details('RunnerError', "'root' user not permitted.")
+            end
+
             DesiredLrpBuilder.new(config, builder_opts(process))
           end
 

spec/unit/lib/cloud_controller/diego/docker/lifecycle_protocol_spec.rb

@@ -118,6 +118,34 @@ module Docker
                 end
               end
             end
+
+            context 'when root user not allowed' do
+              before do
+                TestConfig.override(allow_docker_root_user: false)
+              end
+
+              context 'and the process does not set a user' do
+                let(:app) { AppModel.make(:docker, { droplet: }) }
+                let(:process) { ProcessModel.make(:docker, { app: }) }
+
+                context 'and the droplet docker execution metadata sets the root user' do
+                  let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"],"user":"root"}' }
+                  let(:droplet) do
+                    DropletModel.make(:docker, {
+                                        state: DropletModel::STAGED_STATE,
+                                        docker_receipt_image: 'the-image',
+                                        execution_metadata: droplet_execution_metadata
+                                      })
+                  end
+
+                  it 'raises an error' do
+                    expect do
+                      lifecycle_protocol.desired_lrp_builder(config, process)
+                    end.to raise_error(::CloudController::Errors::ApiError, /'root' user not permitted/)
+                  end
+                end
+              end
+            end
           end
 
           describe '#task_action_builder' do
@@ -138,6 +166,34 @@ module Docker
               )
               lifecycle_protocol.task_action_builder(config, task)
             end
+
+            context 'when root user not allowed' do
+              before do
+                TestConfig.override(allow_docker_root_user: false)
+              end
+
+              context 'and the task does not set a user' do
+                let(:app) { AppModel.make(:docker, { droplet: }) }
+                let(:task) { TaskModel.make(:docker, { droplet:, app: }) }
+
+                context 'and the droplet docker execution metadata sets the root user' do
+                  let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"],"user":"root"}' }
+                  let(:droplet) do
+                    DropletModel.make(:docker, {
+                                        state: DropletModel::STAGED_STATE,
+                                        docker_receipt_image: 'the-image',
+                                        execution_metadata: droplet_execution_metadata
+                                      })
+                  end
+
+                  it 'raises an error' do
+                    expect do
+                      lifecycle_protocol.task_action_builder(config, task)
+                    end.to raise_error(::CloudController::Errors::ApiError, /'root' user not permitted/)
+                  end
+                end
+              end
+            end
           end
         end
       end