Stop using root in container-scanning analyzer
This MR changes the user from root
to a non-root user in the container.
Related to gitlab-org/gitlab#273530 (closed).
-
Add non root user gitlab
to the container -
ADDITIONAL_CA_CERT_BUNDLE
content gets written to/usr/local/share/ca-certificates/custom.crt
and copied to/usr/lib/ssl/certs/
which a non-root user would not have permission to read/write. It has to be changed to a directory that the non-root user has permission to read/write. -
/script/setup_integration
installs few dependencies for bootstrapping the test environment. Since it usesapt-get
, it has to be run in sudo mode. -
WORKDIR
points to the root directory which a non-root user would not have permission to read/write. It has to be changed to a directory (/home/gitlab
) that the non-root user have permission to read/write.
Testing
This MR is tested against branch root-master-patch-33546 in the OpenShift environment. These cases are covered with sk-273530-stop-root image from the registry:
- Successful scan of docker image without any permission error: http://gitlab.apps.secure-stage-openshift-test.k8s-ft.win/root/container-scanning/-/jobs/956
- Successful scan with a value for
ADDITIONAL_CA_CERT_BUNDLE
without any error on ssl certs: http://gitlab.apps.secure-stage-openshift-test.k8s-ft.win/root/container-scanning/-/jobs/954 - Error on scan of docker image using
CS_MAJOR_VERION: 4
which run in root user mode: http://gitlab.apps.secure-stage-openshift-test.k8s-ft.win/root/container-scanning/-/jobs/954
Edited by Sashi Kumar Kumaresan