aws / aws/aws-cli

Why is this the official Docker container running with `id=0` (AKA `root` user and following security permissions)?

Open
#5,120 15 comments 12 reactions 0 assignees View on GitHub
docker feature-request needs-discussion p2 v2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

Confirm by changing [ ] to [x] below:
- [x] I've gone though the [User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) and the [API reference](https://docs.aws.amazon.com/cli/latest/reference/)
- [x] I've searched for [previous similar issues](https://github.com/aws/aws-cli/issues) and didn't find any solution

Issue is about usage on:
- [ ] Service API : I want to do X using Y service, what should I do?
- [x] CLI : passing arguments or cli configurations.
- [x] Other/Not sure.

**Platform/OS/Hardware/Device**
What are you running the cli on?
Docker. Particularly;
```
-> $ docker images | grep aws
amazon/aws-cli latest 886e608c1999 3 days ago 287MB
```

**Describe the question**
> Why is this the official Docker container running with `id=0` (AKA `root` user and following security permissions)?

This I find problematic for the following reasons;
1. All writes performed (as and when instructed by the user to the CLI) to the filesystem results in files created as owned by root.
- Example; (1) new user uses official docker image, and (2) logs in. Now (3) has a `~/.aws` folder (and files within) owned by root, and maybe not readable by the user's own user account on system.
2. This is already a recommended security practice, tons of blog posts and fearmongering stories to be found after cursory web searches. Here's Docker's own official take; https://docs.docker.com/engine/security/rootless/
3. This breaks most OS's paradigm of
```
A user's files and folders in said user's home directory should by default
be readable and writable/executable (where applicable) by the user's own
permissions - however implemented by OS.
```
I struggle to understand why the `aws` CLI should necessitate to belong to the small list of exceptions that normally transcend this paradigms' rule.

However, there certainly are tools and limitations which require _some_ sort of sudo permissions on Linux-based systems (such like `ping` and other issues listed [here](https://docs.docker.com/engine/security/rootless/#known-limitations)).

**I'm opening this issue with the hope of exploring following topics/questions;**
1. Has this ever been considered/discussed/explored beyond "coffe talk over lunch" anywhere? I couldn't find any such conversation in any issue. Would help to know what thoughts have been put into this (if any) previously.
2. How much effort would it be to ensure that no `root` permissions are _ever_ needed by default? There's nothing stopping a user from forcing a docker container to run with root priveliges on docker host machine...

**Logs/output**
Get full traceback and error logs by adding `--debug` to the command.
Not applicable.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.