Skip to content

Commit 5faae35

Browse files
committed
feat: restricted security context
1 parent 171ee6d commit 5faae35

File tree

4 files changed

+48
-17
lines changed

4 files changed

+48
-17
lines changed

bento-downloader/Dockerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,13 @@ RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud
1111
&& tar -xf google-cloud-cli-410.tar.gz \
1212
&& ./google-cloud-sdk/install.sh \
1313
&& rm google-cloud-cli-410.tar.gz
14+
15+
ARG USERNAME=yetone
16+
ARG USER_UID=1000
17+
ARG USER_GID=$USER_UID
18+
19+
# Create the user
20+
RUN groupadd --gid $USER_GID $USERNAME \
21+
&& useradd --uid $USER_UID --gid $USER_GID -m $USERNAME
22+
23+
USER $USER_UID

bento-downloader/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
IMAGE := quay.io/bentoml/bento-downloader:0.0.1
1+
IMAGE := quay.io/bentoml/bento-downloader:0.0.3
22

33
build:
44
docker build -t ${IMAGE} .

controllers/resources/bentorequest_controller.go

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
"k8s.io/apimachinery/pkg/runtime"
3636
"k8s.io/apimachinery/pkg/types"
3737
"k8s.io/client-go/tools/record"
38+
"k8s.io/utils/pointer"
3839
ctrl "sigs.k8s.io/controller-runtime"
3940
"sigs.k8s.io/controller-runtime/pkg/client"
4041
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -1170,6 +1171,17 @@ echo "Done"
11701171
})
11711172
}
11721173

1174+
restrictedSecurityContext := &corev1.SecurityContext{
1175+
AllowPrivilegeEscalation: pointer.BoolPtr(false),
1176+
RunAsNonRoot: pointer.BoolPtr(true),
1177+
SeccompProfile: &corev1.SeccompProfile{
1178+
Type: corev1.SeccompProfileTypeRuntimeDefault,
1179+
},
1180+
Capabilities: &corev1.Capabilities{
1181+
Drop: []corev1.Capability{"ALL"},
1182+
},
1183+
}
1184+
11731185
initContainers := []corev1.Container{
11741186
{
11751187
Name: "bento-downloader",
@@ -1179,9 +1191,10 @@ echo "Done"
11791191
"-c",
11801192
bentoDownloadCommand,
11811193
},
1182-
VolumeMounts: volumeMounts,
1183-
Resources: downloaderContainerResources,
1184-
EnvFrom: downloaderContainerEnvFrom,
1194+
VolumeMounts: volumeMounts,
1195+
Resources: downloaderContainerResources,
1196+
EnvFrom: downloaderContainerEnvFrom,
1197+
SecurityContext: restrictedSecurityContext,
11851198
},
11861199
}
11871200

@@ -1294,9 +1307,10 @@ echo "Done"
12941307
"-c",
12951308
modelDownloadCommand,
12961309
},
1297-
VolumeMounts: volumeMounts,
1298-
Resources: downloaderContainerResources,
1299-
EnvFrom: downloaderContainerEnvFrom,
1310+
VolumeMounts: volumeMounts,
1311+
Resources: downloaderContainerResources,
1312+
EnvFrom: downloaderContainerEnvFrom,
1313+
SecurityContext: restrictedSecurityContext,
13001314
})
13011315
}
13021316

@@ -1498,6 +1512,7 @@ echo "Done"
14981512
Env: envs,
14991513
TTY: true,
15001514
Stdin: true,
1515+
SecurityContext: restrictedSecurityContext,
15011516
}
15021517

15031518
if opt.BentoRequest.Spec.ImageBuilderContainerResources != nil {
@@ -1517,6 +1532,12 @@ echo "Done"
15171532
Containers: []corev1.Container{
15181533
container,
15191534
},
1535+
SecurityContext: &corev1.PodSecurityContext{
1536+
RunAsNonRoot: pointer.BoolPtr(true),
1537+
SeccompProfile: &corev1.SeccompProfile{
1538+
Type: corev1.SeccompProfileTypeRuntimeDefault,
1539+
},
1540+
},
15201541
},
15211542
}
15221543

helm/yatai-image-builder/values.yaml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,16 @@ serviceAccount:
2727

2828
podAnnotations: {}
2929

30-
podSecurityContext: {}
31-
# fsGroup: 2000
30+
podSecurityContext:
31+
runAsNonRoot: true
32+
seccompProfile:
33+
type: RuntimeDefault
3234

33-
securityContext: {}
34-
# capabilities:
35-
# drop:
36-
# - ALL
37-
# readOnlyRootFilesystem: true
38-
# runAsNonRoot: true
39-
# runAsUser: 1000
35+
securityContext:
36+
allowPrivilegeEscalation: false
37+
capabilities:
38+
drop:
39+
- ALL
4040

4141
service:
4242
type: ClusterIP
@@ -96,5 +96,5 @@ aws:
9696
secretAccessKeyExistingSecretKey: ''
9797

9898
internalImages:
99-
bentoDownloader: quay.io/bentoml/bento-downloader:0.0.1
99+
bentoDownloader: quay.io/bentoml/bento-downloader:0.0.3
100100
kaniko: quay.io/bentoml/kaniko:1.9.1

0 commit comments

Comments
 (0)