Skip to content

create non-root users for containers #3020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

create non-root users for containers #3020

wants to merge 2 commits into from

Conversation

@rcmadhankumar
Copy link
Contributor

@rcmadhankumar rcmadhankumar commented Oct 7, 2025 •
edited
Loading

Adding non root users to bci containers.

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
9353e61
bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
472abd4
bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
d343dd2
@github-actions
Copy link

github-actions bot commented Oct 7, 2025 •
edited
Loading

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3020
Changes pushed to branch 16.0-3020 as commit 9ecde44279de56a0a71723be5ec3dd5a17dec665
Build failed ❌

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for x86_64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for aarch64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for s390x: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for ppc64le: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for x86_64: current state: published
Build results:

package name status build log
git-image ❌ failed live log
helm-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for aarch64: current state: published
Build results:

package name status build log
git-image ❌ failed live log
helm-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for s390x: current state: published
Build results:

package name status build log
git-image ❌ failed live log
helm-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for ppc64le: current state: published
Build results:

package name status build log
git-image ❌ failed live log
helm-image ✅ succeeded live log

Build failed ❌

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3020/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3020/containerfile/suse/helm:3

@rcmadhankumar rcmadhankumar force-pushed the non-root-users-creation branch from fab916b to f6d72a8 Compare October 7, 2025 08:35
@github-actions
Copy link

github-actions bot commented Oct 7, 2025 •
edited
Loading

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020
Changes pushed to branch Tumbleweed-3020 as commit d45fe67769c5c3b0dce956d310e8d300f8ba0ec9
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for x86_64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-1.31-image ⛔ excluded live log
kubectl-1.32-image ⛔ excluded live log
kubectl-1.33-image ⛔ excluded live log
kubectl-1.34-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for aarch64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-1.31-image ⛔ excluded live log
kubectl-1.32-image ⛔ excluded live log
kubectl-1.33-image ⛔ excluded live log
kubectl-1.34-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for x86_64: current state: published
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-1.31-image ✅ succeeded live log
kubectl-1.32-image ✅ succeeded live log
kubectl-1.33-image ✅ succeeded live log
kubectl-1.34-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for aarch64: current state: published
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-1.31-image ✅ succeeded live log
kubectl-1.32-image ✅ succeeded live log
kubectl-1.33-image ✅ succeeded live log
kubectl-1.34-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/git:latest
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/helm:latest
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/kubectl:latest
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/samba-client:latest
  • registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/samba-toolbox:latest

@github-actions
Copy link

github-actions bot commented Oct 7, 2025 •
edited
Loading

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3020
Changes pushed to branch 7-3020 as commit c7de71a732724f095041e5d72910cf0939aec0f6
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for x86_64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-oldstable-image ⛔ excluded live log
kubectl-stable-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for aarch64: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-oldstable-image ⛔ excluded live log
kubectl-stable-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for s390x: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-oldstable-image ⛔ excluded live log
kubectl-stable-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for ppc64le: current state: published
Build results:

package name status build log
git-image ⛔ excluded live log
helm-image ⛔ excluded live log
kubectl-oldstable-image ⛔ excluded live log
kubectl-stable-image ⛔ excluded live log
samba-client-image ⛔ excluded live log
samba-toolbox-image ⛔ excluded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for x86_64: current state: publishing
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-oldstable-image ✅ succeeded live log
kubectl-stable-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for aarch64: current state: publishing
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-oldstable-image ✅ succeeded live log
kubectl-stable-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for s390x: current state: publishing
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-oldstable-image ✅ succeeded live log
kubectl-stable-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for ppc64le: current state: publishing
Build results:

package name status build log
git-image ✅ succeeded live log
helm-image ✅ succeeded live log
kubectl-oldstable-image ✅ succeeded live log
kubectl-stable-image ✅ succeeded live log
samba-client-image ✅ succeeded live log
samba-toolbox-image ✅ succeeded live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/ tox -- -n auto
The following images can be pulled from the staging project:
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/git:latest
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/helm:latest
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/kubectl:latest
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/samba-client:latest
  • registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/samba-toolbox:latest

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
d759b19
bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
da8c22c
bci-pushman pushed a commit that referenced this pull request Oct 7, 2025
Test build for #3020
5fbadf4
@rcmadhankumar rcmadhankumar force-pushed the non-root-users-creation branch 2 times, most recently from c03e89a to d60cfe5 Compare October 13, 2025 08:45
@rcmadhankumar rcmadhankumar changed the title [WIP] create non-root users for containers create non-root users for containers Oct 13, 2025
@rcmadhankumar rcmadhankumar force-pushed the non-root-users-creation branch from d60cfe5 to 513bda9 Compare October 13, 2025 08:51
bci-pushman pushed a commit that referenced this pull request Oct 13, 2025
Test build for #3020
74c1b59
bci-pushman pushed a commit that referenced this pull request Oct 13, 2025
Test build for #3020
8437062
bci-pushman pushed a commit that referenced this pull request Oct 13, 2025
Test build for #3020
54c676c
alexandrevicenzi
alexandrevicenzi reviewed Oct 13, 2025
View reviewed changes
src/bci_build/package/git.py
build_stage_custom_end=generate_package_version_check(
"git-core", git_version, ParseVersion.MINOR, use_target=True
),
user_chown=StableUser(
Copy link
Member

@alexandrevicenzi alexandrevicenzi Oct 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need to create a user for Git and such containers? All we need is to set correct file permissions so that it can run with any user.

However, if we go with a Git user, at least the container should use it, which it does not seem to use right now, so this change has not much of an effect on the image.

@rcmadhankumar rcmadhankumar force-pushed the non-root-users-creation branch from 513bda9 to c597281 Compare October 17, 2025 04:56
bci-pushman pushed a commit that referenced this pull request Oct 17, 2025
Test build for #3020
c7de71a
bci-pushman pushed a commit that referenced this pull request Oct 17, 2025
Test build for #3020
9ecde44
bci-pushman pushed a commit that referenced this pull request Oct 17, 2025
Test build for #3020
d45fe67
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alexandrevicenzi alexandrevicenzi alexandrevicenzi left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rcmadhankumar @alexandrevicenzi