Powerpipe: Dashboards for DevOps. Visualize cloud configurations. Assess security posture against a massive library of benchmarks. Build custom dashboards with code.
Powerpipe unavoidably crashes when run in a container that doesn't define the USER environment variable. Setting POWERPIPE_INSALL_DIR doesn't resolve this issue. Setting USER does.
#!/bin/sh
steampipe service start
powerpipe server --port 80
Dockerfile
FROM cgr.dev/chainguard/glibc-dynamic:latest as installer
USER root
RUN wget --output-document=steampipe-install.sh https://raw.githubusercontent.com/turbot/steampipe/main/scripts/install.sh \
&& bash steampipe-install.sh
RUN wget --output-document=powerpipe-install.sh https://raw.githubusercontent.com/turbot/powerpipe/main/scripts/install.sh \
&& bash powerpipe-install.sh
FROM cgr.dev/chainguard/glibc-dynamic:latest
COPY --from=installer /usr/local/bin/steampipe /usr/local/bin/steampipe
COPY --from=installer /usr/local/bin/powerpipe /usr/local/bin/powerpipe
USER nonroot
RUN steampipe plugin install aws
COPY --chown=nonroot:nonroot test /test
COPY --chown=nonroot:nonroot server.sh /test/server.sh
WORKDIR /test
# Initialize Steampipe runtime dependencies during build
RUN steampipe service start
RUN steampipe service stop
ENTRYPOINT /test/server.sh
Describe the bug
Powerpipe unavoidably crashes when run in a container that doesn't define the
USER
environment variable. SettingPOWERPIPE_INSALL_DIR
doesn't resolve this issue. SettingUSER
does.The error seems to be caused by these lines https://github.com/turbot/powerpipe/blob/e5824daddb202efb6e7469a9f294548595920d9c/internal/cmdconfig/app_specific.go#L29-L34
The exact error shows up in my k8s deploymet logs, but I'm unable to reproduce the same traces when running the same docker container locally:
Powerpipe version (
powerpipe -v
) Example: Powerpipe v0.1.3To reproduce Dockerfile and sample shell script included under Additional Context section below.
Expected behavior
Defining
POWERPIPE_INSALL_DIR
as described in Powerpipe: Docs: POWERPIPE_INSALL_DIR and https://github.com/turbot/pipe-fittings/blob/main/app_specific/env.go#L33-L37 should prevent this error.Additional context
server.sh
Dockerfile