sameersbn / sameersbn/docker-gitlab
Run as non-root
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 8.1k
- Forks
- 2.1k
- Avg merge
- 17h 47m
- Merged PRs (30d)
- 7
Description
For security reasons it would be desirable that Gitlab container runs with specific non privileged UID therefore reducing potential exposure surface.
There should be a relatively easy way to manage processes with supervisor without root access.
Services currently binding privileged ports 22,80,443 could be tighten down to non-privileged range. Alternatively if current defaults are to be left as is, services could run as non-root given appropriate linux kernel capabilities.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting how the Docker container currently launches supervisor and binds ports 22, 80, and 443. Compare running those services as a non-root UID with using the Linux capabilities mentioned in the issue; done means the container operates without root while preserving its required services.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100