search

StatCan / kubeflow-containers-desktop

Experimental containers to be used with Kubeflow for a Desktop experience
Other
1 stars 2 forks source link

feat(security): reduce permissions #10

Closed frazs closed 4 years ago

frazs commented 4 years ago

Resolves https://github.com/StatCan/kubeflow-containers/issues/44 Resolves https://github.com/StatCan/kubeflow-containers/issues/25

I did not find a non-root approach for cron, netdata, and rsyslogd. This may still be possible, but is complicated, so if it is a priority it warrants separate issues. I changed the entry in the sudoers file to be specific to the supervisor startup for these programs.

The sha256sum for vs-code-desktop has changed: the install gets the latest version, and there has been an update since the last time that layer was built.

brendangadd commented 4 years ago

@frazs I approved, but I'm wondering if jovyan actually needs sudo on cron etc. Shouldn't the init system take care of launching and monitoring these processes automatically? (If it does, then I do like the specificity of the grants.)

There are some merge conflicts to be resolved. PR needs a rebase.

frazs commented 4 years ago

Do not merge yet: while I have rebased and resolved the merge conflicts, I was not able to complete testing. Build fails for an unrelated reason: the ESlint and Markdown VS Code extensions are no longer at their given location. I need to track down replacements or remove them, and then sort out anything that may or may not come up on further layers.

frazs commented 4 years ago

OK to merge pull request: The VS code extension issue turned out to be a temporary outage, and there are no further issues. I have successfully built and confirmed the functionality of all 3 images.