Skip to content

Commit ad7a74e

Browse files
Kurt-von-LavenKurt-von-Laven
committed
Run Docker container as user 1000 (#1975)
Previously, mega-linter-runner ran the MegaLinter Docker image as root. In the Docker image, chown the /megalinter, /megalinter-descriptors, and /action/lib/.automation directories to be owned by user and group 1000. Users whose files became owned by root as a consequence of having run a previous version of MegaLinter will need to chown them to be owned by user 1000 when upgrading MegaLinter.
1 parent 00df56b commit ad7a74e

File tree

133 files changed

+427
-407
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+427
-407
lines changed

‎.automation/build.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,9 @@ def generate_flavor(flavor, flavor_info):
251251
file.write(action_yml)
252252
logging.info(f"Updated {flavor_action_yml}")
253253
extra_lines = [
254-
"COPY entrypoint.sh /entrypoint.sh",
254+
"COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh",
255255
"RUN chmod +x entrypoint.sh",
256+
"USER 1000",
256257
'ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]',
257258
]
258259
build_dockerfile(

‎CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
2222
- Upgrade create-pull-request and create-or-update-comment GitHub Actions
2323
- Increase auto-update-linters GitHub Action timeout
2424
- Upgrade base Docker image to python:3.11.3-alpine3.17
25+
- Make Docker image rootless, and run it as user 1000 rather than root by
26+
@Kurt-von-Laven in [#1975](https://github.com/oxsecurity/megalinter/issues/1975).
2527

2628
- Documentation
2729

‎Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -666,7 +666,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
666666
################################
667667
# Installs python dependencies #
668668
################################
669-
COPY megalinter /megalinter
669+
COPY --chown=1000:1000 megalinter /megalinter
670670
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
671671
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
672672
&& rm -rf /var/cache/apk/* \
@@ -675,8 +675,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
675675
#######################################
676676
# Copy scripts and rules to container #
677677
#######################################
678-
COPY megalinter/descriptors /megalinter-descriptors
679-
COPY TEMPLATES /action/lib/.automation
678+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
679+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
680680

681681
###########################
682682
# Get the build arguments #
@@ -715,7 +715,8 @@ LABEL com.github.actions.name="MegaLinter" \
715715
org.opencontainers.image.description="Lint your code base with GitHub Actions"
716716

717717
#EXTRA_DOCKERFILE_LINES__START
718-
COPY entrypoint.sh /entrypoint.sh
718+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
719719
RUN chmod +x entrypoint.sh
720+
USER 1000
720721
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
721722
#EXTRA_DOCKERFILE_LINES__END

‎flavors/ci_light/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ RUN wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/m
207207
################################
208208
# Installs python dependencies #
209209
################################
210-
COPY megalinter /megalinter
210+
COPY --chown=1000:1000 megalinter /megalinter
211211
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
212212
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
213213
&& rm -rf /var/cache/apk/* \
@@ -216,8 +216,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
216216
#######################################
217217
# Copy scripts and rules to container #
218218
#######################################
219-
COPY megalinter/descriptors /megalinter-descriptors
220-
COPY TEMPLATES /action/lib/.automation
219+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
220+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
221221

222222
###########################
223223
# Get the build arguments #
@@ -256,7 +256,8 @@ LABEL com.github.actions.name="MegaLinter" \
256256
org.opencontainers.image.description="Lint your code base with GitHub Actions"
257257

258258
#EXTRA_DOCKERFILE_LINES__START
259-
COPY entrypoint.sh /entrypoint.sh
259+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
260260
RUN chmod +x entrypoint.sh
261+
USER 1000
261262
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
262263
#EXTRA_DOCKERFILE_LINES__END

‎flavors/cupcake/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -448,7 +448,7 @@ ENV KICS_QUERIES_PATH=/opt/kics/assets/queries KICS_LIBRARIES_PATH=/opt/kics/ass
448448
################################
449449
# Installs python dependencies #
450450
################################
451-
COPY megalinter /megalinter
451+
COPY --chown=1000:1000 megalinter /megalinter
452452
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
453453
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
454454
&& rm -rf /var/cache/apk/* \
@@ -457,8 +457,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
457457
#######################################
458458
# Copy scripts and rules to container #
459459
#######################################
460-
COPY megalinter/descriptors /megalinter-descriptors
461-
COPY TEMPLATES /action/lib/.automation
460+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
461+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
462462

463463
###########################
464464
# Get the build arguments #
@@ -497,7 +497,8 @@ LABEL com.github.actions.name="MegaLinter" \
497497
org.opencontainers.image.description="Lint your code base with GitHub Actions"
498498

499499
#EXTRA_DOCKERFILE_LINES__START
500-
COPY entrypoint.sh /entrypoint.sh
500+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
501501
RUN chmod +x entrypoint.sh
502+
USER 1000
502503
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
503504
#EXTRA_DOCKERFILE_LINES__END

‎flavors/documentation/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
294294
################################
295295
# Installs python dependencies #
296296
################################
297-
COPY megalinter /megalinter
297+
COPY --chown=1000:1000 megalinter /megalinter
298298
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
299299
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
300300
&& rm -rf /var/cache/apk/* \
@@ -303,8 +303,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
303303
#######################################
304304
# Copy scripts and rules to container #
305305
#######################################
306-
COPY megalinter/descriptors /megalinter-descriptors
307-
COPY TEMPLATES /action/lib/.automation
306+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
307+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
308308

309309
###########################
310310
# Get the build arguments #
@@ -343,7 +343,8 @@ LABEL com.github.actions.name="MegaLinter" \
343343
org.opencontainers.image.description="Lint your code base with GitHub Actions"
344344

345345
#EXTRA_DOCKERFILE_LINES__START
346-
COPY entrypoint.sh /entrypoint.sh
346+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
347347
RUN chmod +x entrypoint.sh
348+
USER 1000
348349
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
349350
#EXTRA_DOCKERFILE_LINES__END

‎flavors/dotnet/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -389,7 +389,7 @@ RUN curl --retry 5 --retry-delay 5 -sLO "${ARM_TTK_URI}" \
389389
################################
390390
# Installs python dependencies #
391391
################################
392-
COPY megalinter /megalinter
392+
COPY --chown=1000:1000 megalinter /megalinter
393393
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
394394
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
395395
&& rm -rf /var/cache/apk/* \
@@ -398,8 +398,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
398398
#######################################
399399
# Copy scripts and rules to container #
400400
#######################################
401-
COPY megalinter/descriptors /megalinter-descriptors
402-
COPY TEMPLATES /action/lib/.automation
401+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
402+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
403403

404404
###########################
405405
# Get the build arguments #
@@ -438,7 +438,8 @@ LABEL com.github.actions.name="MegaLinter" \
438438
org.opencontainers.image.description="Lint your code base with GitHub Actions"
439439

440440
#EXTRA_DOCKERFILE_LINES__START
441-
COPY entrypoint.sh /entrypoint.sh
441+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
442442
RUN chmod +x entrypoint.sh
443+
USER 1000
443444
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
444445
#EXTRA_DOCKERFILE_LINES__END

‎flavors/go/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
309309
################################
310310
# Installs python dependencies #
311311
################################
312-
COPY megalinter /megalinter
312+
COPY --chown=1000:1000 megalinter /megalinter
313313
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
314314
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
315315
&& rm -rf /var/cache/apk/* \
@@ -318,8 +318,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
318318
#######################################
319319
# Copy scripts and rules to container #
320320
#######################################
321-
COPY megalinter/descriptors /megalinter-descriptors
322-
COPY TEMPLATES /action/lib/.automation
321+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
322+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
323323

324324
###########################
325325
# Get the build arguments #
@@ -358,7 +358,8 @@ LABEL com.github.actions.name="MegaLinter" \
358358
org.opencontainers.image.description="Lint your code base with GitHub Actions"
359359

360360
#EXTRA_DOCKERFILE_LINES__START
361-
COPY entrypoint.sh /entrypoint.sh
361+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
362362
RUN chmod +x entrypoint.sh
363+
USER 1000
363364
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
364365
#EXTRA_DOCKERFILE_LINES__END

‎flavors/java/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${P
322322
################################
323323
# Installs python dependencies #
324324
################################
325-
COPY megalinter /megalinter
325+
COPY --chown=1000:1000 megalinter /megalinter
326326
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
327327
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
328328
&& rm -rf /var/cache/apk/* \
@@ -331,8 +331,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
331331
#######################################
332332
# Copy scripts and rules to container #
333333
#######################################
334-
COPY megalinter/descriptors /megalinter-descriptors
335-
COPY TEMPLATES /action/lib/.automation
334+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
335+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
336336

337337
###########################
338338
# Get the build arguments #
@@ -371,7 +371,8 @@ LABEL com.github.actions.name="MegaLinter" \
371371
org.opencontainers.image.description="Lint your code base with GitHub Actions"
372372

373373
#EXTRA_DOCKERFILE_LINES__START
374-
COPY entrypoint.sh /entrypoint.sh
374+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
375375
RUN chmod +x entrypoint.sh
376+
USER 1000
376377
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
377378
#EXTRA_DOCKERFILE_LINES__END

‎flavors/javascript/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
310310
################################
311311
# Installs python dependencies #
312312
################################
313-
COPY megalinter /megalinter
313+
COPY --chown=1000:1000 megalinter /megalinter
314314
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
315315
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
316316
&& rm -rf /var/cache/apk/* \
@@ -319,8 +319,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
319319
#######################################
320320
# Copy scripts and rules to container #
321321
#######################################
322-
COPY megalinter/descriptors /megalinter-descriptors
323-
COPY TEMPLATES /action/lib/.automation
322+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
323+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
324324

325325
###########################
326326
# Get the build arguments #
@@ -359,7 +359,8 @@ LABEL com.github.actions.name="MegaLinter" \
359359
org.opencontainers.image.description="Lint your code base with GitHub Actions"
360360

361361
#EXTRA_DOCKERFILE_LINES__START
362-
COPY entrypoint.sh /entrypoint.sh
362+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
363363
RUN chmod +x entrypoint.sh
364+
USER 1000
364365
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
365366
#EXTRA_DOCKERFILE_LINES__END

‎flavors/php/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -338,7 +338,7 @@ RUN composer global require --ignore-platform-reqs overtrue/phplint ^5.3 \
338338
################################
339339
# Installs python dependencies #
340340
################################
341-
COPY megalinter /megalinter
341+
COPY --chown=1000:1000 megalinter /megalinter
342342
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
343343
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
344344
&& rm -rf /var/cache/apk/* \
@@ -347,8 +347,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
347347
#######################################
348348
# Copy scripts and rules to container #
349349
#######################################
350-
COPY megalinter/descriptors /megalinter-descriptors
351-
COPY TEMPLATES /action/lib/.automation
350+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
351+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
352352

353353
###########################
354354
# Get the build arguments #
@@ -387,7 +387,8 @@ LABEL com.github.actions.name="MegaLinter" \
387387
org.opencontainers.image.description="Lint your code base with GitHub Actions"
388388

389389
#EXTRA_DOCKERFILE_LINES__START
390-
COPY entrypoint.sh /entrypoint.sh
390+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
391391
RUN chmod +x entrypoint.sh
392+
USER 1000
392393
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
393394
#EXTRA_DOCKERFILE_LINES__END

‎flavors/python/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
305305
################################
306306
# Installs python dependencies #
307307
################################
308-
COPY megalinter /megalinter
308+
COPY --chown=1000:1000 megalinter /megalinter
309309
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
310310
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
311311
&& rm -rf /var/cache/apk/* \
@@ -314,8 +314,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
314314
#######################################
315315
# Copy scripts and rules to container #
316316
#######################################
317-
COPY megalinter/descriptors /megalinter-descriptors
318-
COPY TEMPLATES /action/lib/.automation
317+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
318+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
319319

320320
###########################
321321
# Get the build arguments #
@@ -354,7 +354,8 @@ LABEL com.github.actions.name="MegaLinter" \
354354
org.opencontainers.image.description="Lint your code base with GitHub Actions"
355355

356356
#EXTRA_DOCKERFILE_LINES__START
357-
COPY entrypoint.sh /entrypoint.sh
357+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
358358
RUN chmod +x entrypoint.sh
359+
USER 1000
359360
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
360361
#EXTRA_DOCKERFILE_LINES__END

‎flavors/ruby/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
295295
################################
296296
# Installs python dependencies #
297297
################################
298-
COPY megalinter /megalinter
298+
COPY --chown=1000:1000 megalinter /megalinter
299299
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
300300
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
301301
&& rm -rf /var/cache/apk/* \
@@ -304,8 +304,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
304304
#######################################
305305
# Copy scripts and rules to container #
306306
#######################################
307-
COPY megalinter/descriptors /megalinter-descriptors
308-
COPY TEMPLATES /action/lib/.automation
307+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
308+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
309309

310310
###########################
311311
# Get the build arguments #
@@ -344,7 +344,8 @@ LABEL com.github.actions.name="MegaLinter" \
344344
org.opencontainers.image.description="Lint your code base with GitHub Actions"
345345

346346
#EXTRA_DOCKERFILE_LINES__START
347-
COPY entrypoint.sh /entrypoint.sh
347+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
348348
RUN chmod +x entrypoint.sh
349+
USER 1000
349350
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
350351
#EXTRA_DOCKERFILE_LINES__END

‎flavors/rust/Dockerfile

+5-4
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: Fil
289289
################################
290290
# Installs python dependencies #
291291
################################
292-
COPY megalinter /megalinter
292+
COPY --chown=1000:1000 megalinter /megalinter
293293
RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
294294
&& PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py clean --all \
295295
&& rm -rf /var/cache/apk/* \
@@ -298,8 +298,8 @@ RUN PYTHONDONTWRITEBYTECODE=1 python /megalinter/setup.py install \
298298
#######################################
299299
# Copy scripts and rules to container #
300300
#######################################
301-
COPY megalinter/descriptors /megalinter-descriptors
302-
COPY TEMPLATES /action/lib/.automation
301+
COPY --chown=1000:1000 megalinter/descriptors /megalinter-descriptors
302+
COPY --chown=1000:1000 TEMPLATES /action/lib/.automation
303303

304304
###########################
305305
# Get the build arguments #
@@ -338,7 +338,8 @@ LABEL com.github.actions.name="MegaLinter" \
338338
org.opencontainers.image.description="Lint your code base with GitHub Actions"
339339

340340
#EXTRA_DOCKERFILE_LINES__START
341-
COPY entrypoint.sh /entrypoint.sh
341+
COPY --chown=1000:1000 entrypoint.sh /entrypoint.sh
342342
RUN chmod +x entrypoint.sh
343+
USER 1000
343344
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
344345
#EXTRA_DOCKERFILE_LINES__END

0 commit comments

Comments
 (0)