diff --git a/Dockerfile b/Dockerfile index f201c59..0de1308 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,6 @@ RUN build/build.sh # STAGE 2: Runtime FROM alpine -USER nobody:nobody COPY --from=build /go/bin/kuard /kuard CMD [ "/kuard" ] diff --git a/Dockerfile.kuard b/Dockerfile.kuard index 62c7654..7874812 100644 --- a/Dockerfile.kuard +++ b/Dockerfile.kuard @@ -16,5 +16,7 @@ FROM ARG_FROM ADD bin/ARG_FAKEVER/ARG_ARCH/kuard /kuard -USER nobody:nobody +# Set non-root nobody:nobody user (using UID:GID to support k8s SecurityContext runAsNonRoot:true) +USER 65534:65534 + CMD ["/kuard"] diff --git a/Dockerfile.nomultistage b/Dockerfile.nomultistage index edc45a0..38f208d 100644 --- a/Dockerfile.nomultistage +++ b/Dockerfile.nomultistage @@ -21,7 +21,9 @@ ENV VERSION=test # Do the build. Script is part of incoming sources. RUN build/build.sh -# At runtime run as non-root user +# Set non-root nobody:nobody user (using UID:GID to support k8s SecurityContext runAsNonRoot:true) +USER 65534:65534 + USER nobody:nobody CMD [ "/go/bin/kuard" ] \ No newline at end of file