cockroachdb / cockroachdb/cockroach
Add a default non root user in cockraochdb docker image
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**Is your feature request related to a problem? Please describe.**
It is best practice to **not** run docker containers with a root user. The current cockroachdb docker image does not come with a user specified, which means the user inside the container is root by default.
Ref. https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user
**Describe the solution you'd like**
It would be helpful, and more secure, if the image came with an unprivileged user configured out of the box. For example, a 'cockroach' user in a 'cockroach' group.
It would be possible for people who currently use the docker image, and for some reason wish to keep running it as root, to specify '-u root' when running the image.
**Describe alternatives you've considered**
There are other ways of setting a user, for example with '-u' when running the container. This is inconvenient however, as care needs to be taken that nothing breaks due to permission problems.
**Additional context**
I believe this is controlled by the Dockerfile here: https://github.com/cockroachdb/cockroach/blob/cb36e3bd851ff5fee1bacb6cd96711da5336e697/build/deploy/Dockerfile
Jira issue: CRDB-25116
Contributor guide
Assessment
This issue has not been assessed yet.