streamnative / function-mesh

The serverless framework purpose-built for event streaming applications.
https://functionmesh.io/
Apache License 2.0
210 stars 27 forks source link

Use numeric uid:gid in Dockerfile to support Tanzu's PSP #720

Closed lhotari closed 5 months ago

lhotari commented 5 months ago

Motivation

Tanzu Kubernetes Grid 1.22.9 requires that docker images have numeric userids. Running an distroless nonroot image with "USER nonroot:nonroot" will fail to start with this error when default pod security policy is enabled: "Error: container has runAsNonRoot and image has non-numeric user (nonroot), cannot verify user is non-root"

Modifications

Replace USER nonroot:nonroot with USER 65532:65532. Similar solution is commonly used for images using distroless nonroot base image. For example, https://github.com/grafana/loki/blob/main/operator/Dockerfile#L26

Documentation

Check the box below.

Need to update docs?

lhotari commented 5 months ago

Please review and merge @freeznet @jiangpengcheng @nlu90 . Thanks!