search

31z4 / zookeeper-docker

Docker image packaging for Apache Zookeeper
MIT License
285 stars 245 forks source link

Incorrect default uid/gid #165

Closed avanide closed 3 months ago

avanide commented 3 months ago

Describe the bug The dockerfile is using uid 1000 which is considered as a bad practice. The default uid/gid should follow security recommendations (>=10000). I've noticed the related link: https://github.com/31z4/zookeeper-docker/pull/89 The point is that it should be default.

To Reproduce Just check the Dockerfile:

Expected behavior Many security tools considers using a uid >= 10000 is recommended to reduce the likelihood of privilege escalation. Sources:

https://www.tenable.com/policies/cloud-security/AC_K8S_0079 (medium)
https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-37 (low)
https://docs.prowler.com/checks/kubernetes/kubernetes-policy-index/bc_k8s_37/

System configuration Docker environment.

Additional context None

avanide commented 3 months ago

Considering the reply from rabbitmq project (see link). I'm closing this issue here too. Sorry for the inconvenience.