Use non-root user for Dockerfile of helm-manager

Signed-off-by: ecaiyanlinux <martin.c.yan@est.tech>
Issue-ID: NONRTRIC-647
Change-Id: Ic9d82606c25f63096278b22efbe670382dd73468

diff --git a/helm-manager/Dockerfile b/helm-manager/Dockerfile
index 5e96b60..b50767c 100644 (file)
--- a/helm-manager/Dockerfile
+++ b/helm-manager/Dockerfile
@@ -46,4 +46,20 @@ COPY config/application.yaml .
 WORKDIR /opt/app/helm-manager
 COPY target/app.jar app.jar
 
+ARG user=nonrtric
+ARG group=nonrtric
+
+RUN groupadd $group && \
+    useradd -r -g $group $user
+RUN chown -R $user:$group /opt/app/helm-manager
+RUN chown -R $user:$group /etc/app/helm-manager
+
+RUN mkdir /var/helm-manager-service
+RUN chown -R $user:$group /var/helm-manager-service
+
+RUN mkdir /home/$user
+RUN chown -R $user:$group /home/$user
+
+USER $user
+
 CMD [ "java", "-jar", "app.jar", "--spring.config.location=optional:file:/etc/app/helm-manager/"]

diff --git a/helm-manager/docker-hm.sh b/helm-manager/docker-hm.sh
index e51b531..9844f4d 100755 (executable)
--- a/helm-manager/docker-hm.sh
+++ b/helm-manager/docker-hm.sh
@@ -25,10 +25,10 @@ docker run \
     --name helmmanagerservice \
     --network nonrtric-docker-net \
     -v $(pwd)/mnt/database:/var/helm-manager/database \
-    -v ~/.kube:/root/.kube \
-    -v ~/.helm:/root/.helm \
-    -v ~/.config/helm:/root/.config/helm \
-    -v ~/.cache/helm:/root/.cache/helm \
+    -v ~/.kube:/home/nonrtric/.kube \
+    -v ~/.helm:/home/nonrtric/.helm \
+    -v ~/.config/helm:/home/nonrtric/.config/helm \
+    -v ~/.cache/helm:/home/nonrtric/.cache/helm \
     -v $(pwd)/config/KubernetesParticipantConfig.json:/opt/app/helm-manager/src/main/resources/config/KubernetesParticipantConfig.json \
     -v $(pwd)/config/application.yaml:/opt/app/helm-manager/src/main/resources/config/application.yaml \
     nexus3.o-ran-sc.org:10004/o-ran-sc/nonrtric-helm-manager:1.1.0-SNAPSHOT

diff --git a/helm-manager/helm-manager.yaml b/helm-manager/helm-manager.yaml
index 2dafed8..dcc4bc5 100644 (file)
--- a/helm-manager/helm-manager.yaml
+++ b/helm-manager/helm-manager.yaml
@@ -63,7 +63,14 @@ spec:
   - name: helm-manager-service-pv
     persistentVolumeClaim:
       claimName: helm-manager-service-pvc
-
+  initContainers:
+  - name: change-ownership-container
+    image: busybox:latest
+    command: ["sh","-c","chown -R 999:1000 /var/helm-manager-service"]
+    resources: {}
+    volumeMounts:
+    - mountPath: /var/helm-manager-service
+      name: helm-manager-service-pv
 ---
 
 apiVersion: v1