Skip to content

Commit 17c97de

Browse files
lbussellmthalman
lbussell
authored and
mthalman
committed
Add non-root user support (#4397)
(cherry picked from commit 4fced56)
1 parent 950718b commit 17c97de

59 files changed

Lines changed: 690 additions & 147 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.runtime-deps.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ Tags | Dockerfile | OS Version
5353
Tags | Dockerfile | OS Version
5454
-----------| -------------| -------------
5555
8.0.0-preview.1-bookworm-slim-amd64, 8.0-preview-bookworm-slim-amd64, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/bookworm-slim/amd64/Dockerfile) | Debian 12
56-
8.0.0-preview.1-alpine3.17-amd64, 8.0-preview-alpine3.17-amd64, 8.0-preview-alpine-amd64, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/alpine3.17/amd64/Dockerfile) | Alpine 3.17
57-
8.0.0-preview.1-jammy-amd64, 8.0-preview-jammy-amd64, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/jammy/amd64/Dockerfile) | Ubuntu 22.04
56+
8.0.0-preview.1-alpine3.17-amd64, 8.0-preview-alpine3.17-amd64, 8.0-preview-alpine-amd64, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/alpine3.17/amd64/Dockerfile) | Alpine 3.17
57+
8.0.0-preview.1-jammy-amd64, 8.0-preview-jammy-amd64, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/jammy/amd64/Dockerfile) | Ubuntu 22.04
5858
8.0.0-preview.1-jammy-chiseled-amd64, 8.0-preview-jammy-chiseled-amd64, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/jammy-chiseled/amd64/Dockerfile) | Ubuntu 22.04
5959

6060
## Linux arm64 Tags
@@ -74,8 +74,8 @@ Tags | Dockerfile | OS Version
7474
Tags | Dockerfile | OS Version
7575
-----------| -------------| -------------
7676
8.0.0-preview.1-bookworm-slim-arm64v8, 8.0-preview-bookworm-slim-arm64v8, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/bookworm-slim/arm64v8/Dockerfile) | Debian 12
77-
8.0.0-preview.1-alpine3.17-arm64v8, 8.0-preview-alpine3.17-arm64v8, 8.0-preview-alpine-arm64v8, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/alpine3.17/arm64v8/Dockerfile) | Alpine 3.17
78-
8.0.0-preview.1-jammy-arm64v8, 8.0-preview-jammy-arm64v8, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/jammy/arm64v8/Dockerfile) | Ubuntu 22.04
77+
8.0.0-preview.1-alpine3.17-arm64v8, 8.0-preview-alpine3.17-arm64v8, 8.0-preview-alpine-arm64v8, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/alpine3.17/arm64v8/Dockerfile) | Alpine 3.17
78+
8.0.0-preview.1-jammy-arm64v8, 8.0-preview-jammy-arm64v8, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/jammy/arm64v8/Dockerfile) | Ubuntu 22.04
7979
8.0.0-preview.1-jammy-chiseled-arm64v8, 8.0-preview-jammy-chiseled-arm64v8, 8.0.0-preview.1-jammy-chiseled, 8.0-preview-jammy-chiseled | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/jammy-chiseled/arm64v8/Dockerfile) | Ubuntu 22.04
8080

8181
## Linux arm32 Tags
@@ -95,8 +95,8 @@ Tags | Dockerfile | OS Version
9595
Tags | Dockerfile | OS Version
9696
-----------| -------------| -------------
9797
8.0.0-preview.1-bookworm-slim-arm32v7, 8.0-preview-bookworm-slim-arm32v7, 8.0.0-preview.1, 8.0.0-preview.1-bookworm-slim, 8.0-preview, 8.0-preview-bookworm-slim | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/bookworm-slim/arm32v7/Dockerfile) | Debian 12
98-
8.0.0-preview.1-alpine3.17-arm32v7, 8.0-preview-alpine3.17-arm32v7, 8.0-preview-alpine-arm32v7, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/alpine3.17/arm32v7/Dockerfile) | Alpine 3.17
99-
8.0.0-preview.1-jammy-arm32v7, 8.0-preview-jammy-arm32v7, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/6.0/jammy/arm32v7/Dockerfile) | Ubuntu 22.04
98+
8.0.0-preview.1-alpine3.17-arm32v7, 8.0-preview-alpine3.17-arm32v7, 8.0-preview-alpine-arm32v7, 8.0.0-preview.1-alpine3.17, 8.0-preview-alpine3.17, 8.0-preview-alpine | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/alpine3.17/arm32v7/Dockerfile) | Alpine 3.17
99+
8.0.0-preview.1-jammy-arm32v7, 8.0-preview-jammy-arm32v7, 8.0.0-preview.1-jammy, 8.0-preview-jammy | [Dockerfile](https://github.com/dotnet/dotnet-docker/blob/main/src/runtime-deps/8.0/jammy/arm32v7/Dockerfile) | Ubuntu 22.04
100100

101101
You can retrieve a list of all available tags for dotnet/runtime-deps at https://mcr.microsoft.com/v2/dotnet/runtime-deps/tags/list.
102102
<!--End of generated tags-->

‎eng/dockerfile-templates/Dockerfile.common-dotnet-envs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
66
set isDistroless to find(OS_VERSION, "distroless") >= 0 || find(OS_VERSION, "chiseled") >= 0 ^
77
set lineContinuation to when(isWindows, "`", "\") ^
8-
set port to when(isDistroless, "8080", "80")
8+
set port to when(isDistroless || (dotnetVersion != "6.0" && dotnetVersion != "7.0"), "8080", "80")
99
}}ENV {{lineContinuation}}
1010
# Configure web servers to bind to port {{port}} when present
11-
ASPNETCORE_URLS=http://+:{{port}} {{lineContinuation}}
11+
{{if dotnetVersion = "6.0" || dotnetVersion = "7.0":ASPNETCORE_URLS=http://+:{{port}}^else:ASPNETCORE_HTTP_PORTS={{port}}}} {{lineContinuation}}
1212
{{InsertTemplate("Dockerfile.env.container")}}{{if isAlpine || (isDistroless && !(isMariner && find(OS_VERSION, "1.0") > 0)): {{lineContinuation}}
1313
# Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
1414
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true}}

‎eng/dockerfile-templates/Dockerfile.linux.install-deps‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -45,17 +45,17 @@
4545
"libstdc++6",
4646
"zlib1g"
4747
])) ^
48-
set certsPkgPrefix to when(isMariner,
49-
[
50-
when(isDistrolessMariner, "prebuilt-ca-certificates", "ca-certificates"),
51-
"",
52-
dotnetDepsComment
53-
],
54-
[
55-
"ca-certificates",
56-
"",
57-
dotnetDepsComment
58-
]) ^
48+
set certsPkgPrefix to when(isMariner,
49+
[
50+
when(isDistrolessMariner, "prebuilt-ca-certificates", "ca-certificates"),
51+
"",
52+
dotnetDepsComment
53+
],
54+
[
55+
"ca-certificates",
56+
"",
57+
dotnetDepsComment
58+
]) ^
5959
set pkgs to when(ARGS["isSdk"], pkgs, cat(certsPkgPrefix, pkgs))
6060
}}{{InsertTemplate("Dockerfile.linux.install-pkgs",
6161
[

‎eng/dockerfile-templates/Dockerfile.linux.install-pkgs‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
pkgs: list of packages to install
44
pkg-mgr (optional): package manager to use
55
pkg-mgr-opts (optional): additional options to pass to the package manager
6-
noninteractive (optional): whether to use noninteractive mode ^
6+
noninteractive (optional): whether to use noninteractive mode
7+
no-clean (optional): skip package manager cleanup after install ^
78

89
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
910
set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
@@ -22,10 +23,10 @@ elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^
2223
else:apt-get update \
2324
&&{{if ARGS["noninteractive"]: DEBIAN_FRONTEND=noninteractive}} apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{
2425
for index, pkg in ARGS["pkgs"]:
25-
{{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{
26+
{{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if !ARGS["no-clean"]:{{
2627
if isTdnf:
2728
&& tdnf clean all{{ARGS["pkg-mgr-opts"]}}^
2829
elif isDnf:
2930
&& dnf clean all{{ARGS["pkg-mgr-opts"]}}^
3031
elif !isApk:
31-
&& rm -rf /var/lib/apt/lists/*}}
32+
&& rm -rf /var/lib/apt/lists/*}}}}

‎eng/dockerfile-templates/Dockerfile.linux.remove-pkgs‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{
2+
_ ARGS:
3+
pkgs: list of packages to remove
4+
pkg-mgr (optional): package manager to use
5+
pkg-mgr-opts (optional): additional options to pass to the package manager
6+
noninteractive (optional): whether to use noninteractive mode
7+
no-clean (optional): skip package manager cleanup after install ^
8+
9+
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
10+
set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
11+
set isDnf to ARGS["pkg-mgr"] = "dnf" ^
12+
set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isMariner) ^
13+
set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine
14+
}}{{
15+
if isDnf:dnf remove -y{{ARGS["pkg-mgr-opts"]}} \^
16+
elif isApk:apk del{{ARGS["pkg-mgr-opts"]}} \^
17+
elif isTdnf:tdnf remove -y{{ARGS["pkg-mgr-opts"]}} \^
18+
else:apt-get remove \
19+
&&{{if ARGS["noninteractive"]: DEBIAN_FRONTEND=noninteractive}} apt-get remove -y {{ARGS["pkg-mgr-opts"]}} \}}{{
20+
for index, pkg in ARGS["pkgs"]:
21+
{{pkg}} \}}{{if !no-clean:{{
22+
if isTdnf:
23+
&& tdnf clean all{{ARGS["pkg-mgr-opts"]}}^
24+
elif isDnf:
25+
&& dnf autoremove{{ARGS["pkg-mgr-opts"]}} \
26+
&& dnf clean all{{ARGS["pkg-mgr-opts"]}}^
27+
elif !isApk:
28+
&& apt-get autoremove \
29+
&& rm -rf /var/lib/apt/lists/*}}}}

‎eng/dockerfile-templates/monitor/Dockerfile.envs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
_ .NET major version matches the major version of dotnet-monitor ^
33
set dotnetMajor to split(PRODUCT_VERSION, ".")[0]
44
}}ENV \
5-
# Unset ASPNETCORE_URLS from aspnet base image
6-
ASPNETCORE_URLS= \
5+
{{if dotnetMajor != "6" && dotnetMajor != "7":# Unset ASPNETCORE_HTTP_PORTS from aspnet base image
6+
ASPNETCORE_HTTP_PORTS= \^else:# Unset ASPNETCORE_URLS from aspnet base image
7+
ASPNETCORE_URLS= \}}
78
# Disable debugger and profiler diagnostics to avoid diagnosing self.
89
COMPlus_EnableDiagnostics=0 \
910
# Default Filter

‎eng/dockerfile-templates/runtime-deps/Dockerfile‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,11 @@
1919
set isRpmInstall to isMariner && dotnetVersion = "6.0" ^
2020
set isSingleStage to !(isRpmInstall && isInternal) ^
2121
set urlSuffix to when(isInternal, "$SAS_QUERY_STRING", "") ^
22-
set rpmFilename to "dotnet-runtime-deps.rpm"
22+
set rpmFilename to "dotnet-runtime-deps.rpm" ^
23+
set utilPkgs to when(isMariner && dotnetVersion != "6.0" && dotnetVersion != "7.0", ["shadow-utils"], []) ^
24+
set username to "app" ^
25+
set uid to 101 ^
26+
set gid to uid
2327
}}{{
2428
if !isSingleStage:# Installer image
2529
}}FROM {{baseImageRepo}}:{{baseImageTag}}{{if !isSingleStage: AS installer}}{{ if isInternal && isRpmInstall:
@@ -52,5 +56,14 @@ RUN {{InsertTemplate("../Dockerfile.linux.install-deps")}}
5256
"url-suffix": urlSuffix,
5357
"filename": rpmFilename
5458
])}}
59+
}}{{if dotnetVersion != "6.0" && dotnetVersion != "7.0":
60+
# Create a non-root user and group
61+
RUN {{InsertTemplate("Dockerfile.linux.non-root-user",
62+
[
63+
"name": username,
64+
"uid": uid,
65+
"gid": gid,
66+
"append-cmd": len(utilPkgs) > 0
67+
])}}
5568
}}
5669
{{InsertTemplate("../Dockerfile.common-dotnet-envs")}}

‎eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,15 @@ FROM {{ARCH_VERSIONED}}/ubuntu:{{osVersionBase}} as builder
1616
RUN apt-get update && \
1717
apt-get install -y ca-certificates
1818

19-
RUN {{InsertTemplate("Dockerfile.linux.distroless-user",
20-
[
19+
RUN {{InsertTemplate("Dockerfile.linux.distroless-user", [
2120
"staging-dir": "/rootfs",
2221
"exclusive": "true",
2322
"create-dir": "true",
2423
"name": username,
2524
"uid": uid,
2625
"gid": gid,
2726
"create-home": "true"
28-
],
29-
" ")}}
27+
])}}
3028

3129
COPY --from=chisel /opt/chisel/chisel /usr/bin/
3230
RUN chisel cut --release "ubuntu-{{osVersionNumber}}" --root /rootfs \

‎eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,8 @@ RUN {{InsertTemplate("Dockerfile.linux.distroless-user",
4040
"name": username,
4141
"uid": uid,
4242
"gid": gid,
43-
"create-home": createUserHome
44-
],
45-
" ")}}
43+
"no-create-home": !createUserHome
44+
])}}
4645

4746
# Clean up staging
4847
RUN rm -rf {{distrolessStagingDir}}/etc/{{when(find(OS_VERSION, "1.0") >= 0, "dnf", "tdnf")}} \

‎eng/dockerfile-templates/runtime-deps/Dockerfile.linux.distroless-user‎

Lines changed: 20 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,28 +7,24 @@
77
name: Name of the user/group to create
88
uid: ID of the user to be created
99
gid: ID of the group to be created
10-
create-home (optional): Indicates whether a home directory should be created for the user ^
10+
no-create-home (optional): Indicates whether a home directory should be created for the user ^
1111
set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^
12-
set isMariner to find(OS_VERSION, "cbl-mariner") >= 0
13-
}}groupadd \
14-
--system \
15-
--gid={{ARGS["gid"]}} \
16-
{{ARGS["name"]}} \
17-
&& adduser \
18-
--uid {{ARGS["uid"]}} \
19-
--gid {{ARGS["gid"]}} \
20-
--shell /bin/false \{{if !ARGS["create-home"]:
21-
--no-create-home \}}
22-
--system \
23-
{{ARGS["name"]}} \{{
24-
if ARGS["create-home"]:
25-
&& install -d -m 0755 -o {{ARGS["uid"]}} -g {{ARGS["gid"]}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{
26-
if ARGS["exclusive"]:{{if ARGS["create-dir"]:
27-
&& mkdir -p "{{ARGS["staging-dir"]}}/etc" \}}
28-
&& rootOrAppRegex='@^\(root\|app\):' \
29-
&& cat /etc/passwd | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/passwd" \
30-
&& cat /etc/group | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/group"^
31-
else:
32-
# Copy user/group info to staging
33-
&& cp /etc/passwd {{ARGS["staging-dir"]}}/etc/passwd \
34-
&& cp /etc/group {{ARGS["staging-dir"]}}/etc/group}}
12+
set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^
13+
set isAlpine to find(OS_VERSION, "alpine") >= 0
14+
}}{{InsertTemplate("Dockerfile.linux.non-root-user",
15+
[
16+
"name": ARGS["name"],
17+
"uid": ARGS["uid"],
18+
"gid": ARGS["gid"],
19+
"no-create-home": ARGS["no-create-home"]
20+
])}} \{{if !ARGS["no-create-home"]:
21+
&& install -d -m 0755 -o {{ARGS["uid"]}} -g {{ARGS["gid"]}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{
22+
if ARGS["exclusive"]:{{if ARGS["create-dir"]:
23+
&& mkdir -p "{{ARGS["staging-dir"]}}/etc" \}}
24+
&& rootOrAppRegex='@^\(root\|app\):' \
25+
&& cat /etc/passwd | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/passwd" \
26+
&& cat /etc/group | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/group"^
27+
else:
28+
# Copy user/group info to staging
29+
&& cp /etc/passwd {{ARGS["staging-dir"]}}/etc/passwd \
30+
&& cp /etc/group {{ARGS["staging-dir"]}}/etc/group}}

0 commit comments

Comments
 (0)