mittwald / mittwald/kube-httpcache

Add ability to run as non root user

Open
#135 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Go
Stars
313
Forks
82
PR merge metrics
No merged PRs in 30d

Description

Is your feature request related to a problem? Please describe.
Microsoft Defender for Cloud recommends that running containers as root user should be avoided. This means that the pod securityContext should contain runAsNonRoot: true. My tests were configured with the following security context:

securityContext:
  runAsNonRoot: true
  runAsUser: 101  # varnish

Currently, the pod fails to start with the following error message since it doesn't have permissions to create a directory under /var/lib/varnish which is owned by root.

Error: Cannot create working directory '/var/lib/varnish/cache-statefulset-0/': Permission denied

Describe the solution you'd like
Ideally, the pod should be able to start as a non root user.

I wonder if this would be at all possible. This doesn't prevent us from using the image since the policy is not enforced but it would be nice to have for compliance with the recommendation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Kubernetes pod configuration and container setup that use /var/lib/varnish, then check how that path is created and owned. Test with runAsNonRoot: true and runAsUser: 101, and confirm the pod starts without the permission-denied error.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.