Skip to content

Commit d334669

Browse files
Kurt-von-LavenKurt-von-Laven
committed
Run Docker container as user 1000 (#1975)
Previously, mega-linter-runner ran the MegaLinter Docker image as root. In the Docker image, chown the /megalinter, /megalinter-descriptors, and /action/lib/.automation directories to be owned by user and group 1000. Users whose files became owned by root as a consequence of having run a previous version of MegaLinter will need to chown them to be owned by user 1000 when upgrading MegaLinter.
1 parent 00df56b commit d334669

File tree

133 files changed

+1042
-392
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+1042
-392
lines changed

‎.automation/build.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,9 @@ def generate_flavor(flavor, flavor_info):
251251
file.write(action_yml)
252252
logging.info(f"Updated {flavor_action_yml}")
253253
extra_lines = [
254-
"COPY entrypoint.sh /entrypoint.sh",
254+
"COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh",
255255
"RUN chmod +x entrypoint.sh",
256+
"USER 1000",
256257
'ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]',
257258
]
258259
build_dockerfile(

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
2222
- Upgrade create-pull-request and create-or-update-comment GitHub Actions
2323
- Increase auto-update-linters GitHub Action timeout
2424
- Upgrade base Docker image to python:3.11.3-alpine3.17
25+
- Make Docker image rootless, and run it as user 1000 rather than root by
26+
@Kurt-von-Laven in [#1975](https://github.com/oxsecurity/megalinter/issues/1975).
2527

2628
- Documentation
2729

‎Dockerfile‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -666,7 +666,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
666666
################################
667667
# Installs python dependencies #
668668
################################
669-
COPY megalinter /megalinter
669+
COPY --chown=1000:1000 megalinter /megalinter
670670
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
671671
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
672672
&& rm -rf /var/cache/apk/* \
@@ -675,8 +675,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
675675
#######################################
676676
# Copy scripts and rules to container #
677677
#######################################
678-
COPY megalinter/descriptors /megalinter-descriptors
679-
COPY TEMPLATES /action/lib/.automation
678+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
679+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
680680

681681
###########################
682682
# Get the build arguments #
@@ -715,7 +715,8 @@ LABEL com.github.actions.name="MegaLinter" \
715715
org.opencontainers.image.description="Lint your code base with GitHub Actions"
716716

717717
#EXTRA_DOCKERFILE_LINES__START
718-
COPY entrypoint.sh /entrypoint.sh
718+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
719719
RUN chmod +x entrypoint.sh
720+
USER 1000
720721
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
721722
#EXTRA_DOCKERFILE_LINES__END

‎flavors/ci_light/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ RUN wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/m
207207
################################
208208
# Installs python dependencies #
209209
################################
210-
COPY megalinter /megalinter
210+
COPY --chown=1000:1000 megalinter /megalinter
211211
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
212212
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
213213
&& rm -rf /var/cache/apk/* \
@@ -216,8 +216,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
216216
#######################################
217217
# Copy scripts and rules to container #
218218
#######################################
219-
COPY megalinter/descriptors /megalinter-descriptors
220-
COPY TEMPLATES /action/lib/.automation
219+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
220+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
221+
222+
#####################################################
223+
# Make the container rootless for sake of security. #
224+
#####################################################
225+
USER 1000
221226

222227
###########################
223228
# Get the build arguments #

‎flavors/cupcake/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -448,7 +448,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
448448
################################
449449
# Installs python dependencies #
450450
################################
451-
COPY megalinter /megalinter
451+
COPY --chown=1000:1000 megalinter /megalinter
452452
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
453453
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
454454
&& rm -rf /var/cache/apk/* \
@@ -457,8 +457,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
457457
#######################################
458458
# Copy scripts and rules to container #
459459
#######################################
460-
COPY megalinter/descriptors /megalinter-descriptors
461-
COPY TEMPLATES /action/lib/.automation
460+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
461+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
462+
463+
#####################################################
464+
# Make the container rootless for sake of security. #
465+
#####################################################
466+
USER 1000
462467

463468
###########################
464469
# Get the build arguments #

‎flavors/documentation/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
294294
################################
295295
# Installs python dependencies #
296296
################################
297-
COPY megalinter /megalinter
297+
COPY --chown=1000:1000 megalinter /megalinter
298298
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
299299
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
300300
&& rm -rf /var/cache/apk/* \
@@ -303,8 +303,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
303303
#######################################
304304
# Copy scripts and rules to container #
305305
#######################################
306-
COPY megalinter/descriptors /megalinter-descriptors
307-
COPY TEMPLATES /action/lib/.automation
306+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
307+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
308+
309+
#####################################################
310+
# Make the container rootless for sake of security. #
311+
#####################################################
312+
USER 1000
308313

309314
###########################
310315
# Get the build arguments #

‎flavors/dotnet/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -389,7 +389,7 @@ RUN curl --retry 5 --retry-delay 5 -sLO "${ARM_TTK_URI}" \
389389
################################
390390
# Installs python dependencies #
391391
################################
392-
COPY megalinter /megalinter
392+
COPY --chown=1000:1000 megalinter /megalinter
393393
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
394394
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
395395
&& rm -rf /var/cache/apk/* \
@@ -398,8 +398,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
398398
#######################################
399399
# Copy scripts and rules to container #
400400
#######################################
401-
COPY megalinter/descriptors /megalinter-descriptors
402-
COPY TEMPLATES /action/lib/.automation
401+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
402+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
403+
404+
#####################################################
405+
# Make the container rootless for sake of security. #
406+
#####################################################
407+
USER 1000
403408

404409
###########################
405410
# Get the build arguments #

‎flavors/go/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
309309
################################
310310
# Installs python dependencies #
311311
################################
312-
COPY megalinter /megalinter
312+
COPY --chown=1000:1000 megalinter /megalinter
313313
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
314314
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
315315
&& rm -rf /var/cache/apk/* \
@@ -318,8 +318,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
318318
#######################################
319319
# Copy scripts and rules to container #
320320
#######################################
321-
COPY megalinter/descriptors /megalinter-descriptors
322-
COPY TEMPLATES /action/lib/.automation
321+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
322+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
323+
324+
#####################################################
325+
# Make the container rootless for sake of security. #
326+
#####################################################
327+
USER 1000
323328

324329
###########################
325330
# Get the build arguments #

‎flavors/java/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${P
322322
################################
323323
# Installs python dependencies #
324324
################################
325-
COPY megalinter /megalinter
325+
COPY --chown=1000:1000 megalinter /megalinter
326326
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
327327
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
328328
&& rm -rf /var/cache/apk/* \
@@ -331,8 +331,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
331331
#######################################
332332
# Copy scripts and rules to container #
333333
#######################################
334-
COPY megalinter/descriptors /megalinter-descriptors
335-
COPY TEMPLATES /action/lib/.automation
334+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
335+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
336+
337+
#####################################################
338+
# Make the container rootless for sake of security. #
339+
#####################################################
340+
USER 1000
336341

337342
###########################
338343
# Get the build arguments #

‎flavors/javascript/Dockerfile‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
310310
################################
311311
# Installs python dependencies #
312312
################################
313-
COPY megalinter /megalinter
313+
COPY --chown=1000:1000 megalinter /megalinter
314314
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
315315
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
316316
&& rm -rf /var/cache/apk/* \
@@ -319,8 +319,13 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
319319
#######################################
320320
# Copy scripts and rules to container #
321321
#######################################
322-
COPY megalinter/descriptors /megalinter-descriptors
323-
COPY TEMPLATES /action/lib/.automation
322+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
323+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
324+
325+
#####################################################
326+
# Make the container rootless for sake of security. #
327+
#####################################################
328+
USER 1000
324329

325330
###########################
326331
# Get the build arguments #

0 commit comments

Comments
 (0)