Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: properly fix permissions on image #198

Closed
wants to merge 1 commit into from
Closed

feat: properly fix permissions on image #198

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& rm -rf /var/lib/apt/lists/*

# Create a non-root user and switch to it
RUN adduser --system --no-create-home codegate --uid 1000
RUN useradd -rm -d /home/codegate -s /bin/bash -g root -G sudo -u 1001 codegate
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, useradd and adduser are equivalents. I'll ack if this moves us forward, but as a general comment I don't understand why we need sudo and why we need the root group.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having documentation about the need for sudo and the root group would be ideal. I would have flagged this as a potential vuln, actually.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's hold for now. I needed that because i was hacking the backup/restore of weaviate_data folder for backup. But i am working on proper backup/restore methods

USER codegate
WORKDIR /app

# Copy necessary artifacts from the builder stage
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /app /app

# change permissions
USER root
RUN chown -R codegate /app
USER codegate

# Set the PYTHONPATH environment variable
ENV PYTHONPATH=/app/src

Expand Down
Loading