Run workspace as non root (#240)

* jovyan user has userid 1000 * update chart version
spotinst · Nov 6, 2024 · c959006 · c959006
1 parent 5f98acb
commit c959006
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/charts/bigdata-notebook-workspace/Chart.yaml b/charts/bigdata-notebook-workspace/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: bigdata-notebook-workspace
 description: A Helm chart for the Spot Big Data Notebook Workspace
 type: application
-version: 0.0.16
+version: 0.0.17
 appVersion: 4.1.8-ofas-31799c9
 home: https://github.com/spotinst/charts
 icon: https://docs.spot.io/_media/images/spot_mark.png

diff --git a/charts/bigdata-notebook-workspace/templates/deployment.yaml b/charts/bigdata-notebook-workspace/templates/deployment.yaml
@@ -52,8 +52,7 @@ spec:
             - containerPort: {{ .Values.containerPort.port }}
               name: {{ .Values.containerPort.name }}
           command:
-            - start-notebook.sh 
-            - --allow-root
+            - start-notebook.py
           args:
           {{- range $key, $value := .Values.server }}
             - --ServerApp.{{ $key | snakecase }}={{$value}}

diff --git a/charts/bigdata-notebook-workspace/values.yaml b/charts/bigdata-notebook-workspace/values.yaml
@@ -58,8 +58,9 @@ volume:
   mountPath: /home/jovyan
 
 podSecurityContext:
-  runAsUser: 0
-  fsGroup: 0
+  runAsNonRoot: true
+  runAsUser: 1000
+  fsGroup: 100
 
 containerPort:
   port: 8888