Add non-root user support #4397
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| {{ | ||
| _ ARGS: | ||
| pkgs: list of packages to remove | ||
| pkg-mgr (optional): package manager to use | ||
| pkg-mgr-opts (optional): additional options to pass to the package manager | ||
| noninteractive (optional): whether to use noninteractive mode | ||
| no-clean (optional): skip package manager cleanup after install ^ | ||
|
|
||
| set isAlpine to find(OS_VERSION, "alpine") >= 0 ^ | ||
| set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^ | ||
| set isDnf to ARGS["pkg-mgr"] = "dnf" ^ | ||
| set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isMariner) ^ | ||
| set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine | ||
| }}{{ | ||
| if isDnf:dnf remove -y{{ARGS["pkg-mgr-opts"]}} \^ | ||
| elif isApk:apk del{{ARGS["pkg-mgr-opts"]}} \^ | ||
| elif isTdnf:tdnf remove -y{{ARGS["pkg-mgr-opts"]}} \^ | ||
| else:apt-get remove \ | ||
| &&{{if ARGS["noninteractive"]: DEBIAN_FRONTEND=noninteractive}} apt-get remove -y {{ARGS["pkg-mgr-opts"]}} \}}{{ | ||
| for index, pkg in ARGS["pkgs"]: | ||
| {{pkg}} \}}{{if !no-clean:{{ | ||
| if isTdnf: | ||
| && tdnf clean all{{ARGS["pkg-mgr-opts"]}}^ | ||
| elif isDnf: | ||
| && dnf autoremove{{ARGS["pkg-mgr-opts"]}} \ | ||
| && dnf clean all{{ARGS["pkg-mgr-opts"]}}^ | ||
| elif !isApk: | ||
| && apt-get autoremove \ | ||
| && rm -rf /var/lib/apt/lists/*}}}} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,8 +2,9 @@ | |
| _ .NET major version matches the major version of dotnet-monitor ^ | ||
| set dotnetMajor to split(PRODUCT_VERSION, ".")[0] | ||
| }}ENV \ | ||
| {{if dotnetMajor != "6" && dotnetMajor != "7":# Unset ASPNETCORE_HTTP_PORTS from aspnet base image | ||
| ASPNETCORE_HTTP_PORTS= \^else:# Unset ASPNETCORE_URLS from aspnet base image | ||
|
There was a problem hiding this comment. @jander-msft - I know you requested this. Can you explain the need for this? Also, should the monitor Dockerfile be configured to run as non-root by default? There was a problem hiding this comment.
.NET Monitor already runs its HTTP server at ports 52323 and 52325 by default. Either setting ASPNETCORE_HTTP_PORTS would override that behavior (which we don't want by default) or it is not observed (which would be bad to insinuate that it has some effect when it does not); I think the former would be the case if the environment variable is specified. I will very later today that this is the case.
That would be great if that could be added too. Although, if this change is only scoped to .NET 8+, then this work shouldn't be necessary because .NET Monitor is only offering distroless and chiseled images for .NET 8+, which should already be using the non-root user. |
||
| ASPNETCORE_URLS= \}} | ||
| # Disable debugger and profiler diagnostics to avoid diagnosing self. | ||
| COMPlus_EnableDiagnostics=0 \ | ||
| # Default Filter | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| {{ | ||
| _ Configures a non-root user | ||
| _ ARGS: | ||
| name: Name of the user/group to create | ||
| uid: ID of the user to be created | ||
| gid: ID of the group to be created | ||
| no-create-home (optional): Indicates whether a home directory should be created for the user ^ | ||
| set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^ | ||
| set isAlpine to find(OS_VERSION, "alpine") >= 0 ^ | ||
| set isDebian to find(OS_ARCH_HYPHENATED, "Debian") >= 0 ^ | ||
| set isMariner to find(OS_VERSION, "cbl-mariner") >= 0 ^ | ||
| set isDistrolessMariner to defined(match(OS_VERSION, "^cbl-mariner\d+\.\d+-distroless$")) ^ | ||
| set utilPkgs to when(isMariner && !isDistrolessMariner && dotnetVersion != "6.0" && dotnetVersion != "7.0", ["shadow-utils"], []) | ||
| }}{{if len(utilPkgs) > 0:{{InsertTemplate("../Dockerfile.linux.install-pkgs", [ | ||
| "pkgs": utilPkgs, | ||
| "no-clean": "true" | ||
| ])}} | ||
| && }}{{if isAlpine:addgroup^else:groupadd}} \ | ||
| --system \ | ||
| --gid={{ARGS["gid"]}} \ | ||
| {{ARGS["name"]}} \ | ||
| && {{if isDebian:useradd^else:adduser}} \ | ||
| --uid {{ARGS["uid"]}} \ | ||
| {{if isAlpine:--ingroup={{ARGS["name"]}}^else:--gid {{ARGS["gid"]}}}} \ | ||
| --shell /bin/false \{{if ARGS["no-create-home"]: | ||
| --no-create-home \^elif dotnetVersion != "6.0" && dotnetVersion != "7.0" && (isMariner || isDebian): | ||
| --create-home \}} | ||
| --system \ | ||
| {{ARGS["name"]}}{{if len(utilPkgs) > 0: \ | ||
| && {{InsertTemplate("../Dockerfile.linux.remove-pkgs", [ | ||
| "pkgs": utilPkgs | ||
| ], " ")}}}} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,5 @@ | ||
| {{ | ||
| _ ARGS | ||
| append-cmd: Indicates whether to append the command to an existing command | ||
| }}# Trigger first run experience by running arbitrary cmd | ||
| {{if ARGS["append-cmd"]:&&^else:RUN}} dotnet help |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.