search

fabric8io-images / java

Java Base Images
Apache License 2.0
176 stars 99 forks source link

Why is the root user used? #62

Open arley9511 opened 4 years ago

arley9511 commented 4 years ago

It is well known that for container-based environments, leaving the root user as the default is a vulnerability.

Actually I use Quarkus and the official Dockefile does not change the user for a non root, my question is have you considered changing the way these images are built to follow best security practices?

rhuss commented 4 years ago

You can use the UBI images that uses a non-root user.

For the others we might consider to change, too. But this might hit some serious bacwards compatibility issues.