Skip to content

run docker container as a non root user #211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
boddumanohar wants to merge 3 commits into
base: master
Choose a base branch
from
Open

run docker container as a non root user #211

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6fd2fcf
run as non root user
boddumanohar Jul 23, 2025
298af63
update security context for CSI Node DS
boddumanohar Jul 24, 2025
5a69c08
add security context for all the storage nodes
boddumanohar Jul 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions charts/spdk-csi/latest/spdk-csi/templates/node.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,10 +73,10 @@ spec:
mountPath: /registration
- name: csi-node
securityContext:
privileged: true
capabilities:
add: ["SYS_ADMIN", "SYS_MODULE"]
allowPrivilegeEscalation: true
privileged: true # Needs to run as root user to access kubelet plugins folder and to load kernel modules
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: true
image: "{{ .Values.image.csi.repository }}:{{ .Values.image.csi.tag }}"
imagePullPolicy: {{ .Values.image.csi.pullPolicy }}
args:
Expand Down
8 changes: 8 additions & 0 deletions charts/spdk-csi/latest/spdk-csi/templates/storage-node.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,14 @@ spec:
hostPath:
path: /lib/modules
hostNetwork: true
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
{{- if .tolerations.create }}
tolerations:
{{- range .tolerations.list }}
Expand Down
22 changes: 17 additions & 5 deletions deploy/image/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,26 @@
#
# XXX: pin alpine to 3.8 with e2fsprogs-1.44
# e2fsprogs-1.45+ crashes my test vm when running mkfs.ext4
FROM alpine:3.18
FROM alpine:3.22
LABEL maintainers="SPDK-CSI Authors"
LABEL description="SPDK-CSI Plugin"

COPY spdkcsi /usr/local/bin/spdkcsi
# Add a non-root system user
RUN addgroup -S spdkcsi && adduser -S -G spdkcsi spdkcsi && \
apk add --no-cache \
blkid \
e2fsprogs \
e2fsprogs-extra \
nvme-cli \
open-iscsi \
util-linux \
xfsprogs \
xfsprogs-extra

RUN apk update && \
apk add nvme-cli open-iscsi e2fsprogs xfsprogs blkid xfsprogs-extra e2fsprogs-extra util-linux
COPY --chown=spdkcsi:spdkcsi spdkcsi /usr/local/bin/spdkcsi
RUN chmod 0755 /usr/local/bin/spdkcsi

ENTRYPOINT ["/usr/local/bin/spdkcsi"]
# Drop to non-root user
USER spdkcsi

ENTRYPOINT ["/usr/local/bin/spdkcsi"]
Loading