mittwald / mittwald/kube-httpcache
Add ability to run as non root user
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 313
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
Is your feature request related to a problem? Please describe.
Microsoft Defender for Cloud recommends that running containers as root user should be avoided. This means that the pod securityContext should contain runAsNonRoot: true. My tests were configured with the following security context:
securityContext:
runAsNonRoot: true
runAsUser: 101 # varnish
Currently, the pod fails to start with the following error message since it doesn't have permissions to create a directory under /var/lib/varnish which is owned by root.
Error: Cannot create working directory '/var/lib/varnish/cache-statefulset-0/': Permission denied
Describe the solution you'd like
Ideally, the pod should be able to start as a non root user.
I wonder if this would be at all possible. This doesn't prevent us from using the image since the policy is not enforced but it would be nice to have for compliance with the recommendation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Kubernetes pod configuration and container setup that use /var/lib/varnish, then check how that path is created and owned. Test with runAsNonRoot: true and runAsUser: 101, and confirm the pod starts without the permission-denied error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100