southfox/miniflux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Fix non-numeric UID

Browse source 
This patch adjusts the distroless image to use the predefined non-root UID, which uses explicit UID definitions. This allows orchestrators like Kubernetes to validate non-zero UIDs directly by checking the Image metadata.

The previous setup without an explicit `runAsUser` in the securityContext would produce the following error when enabling `runAsNonRoot`:

```
Error: container has runAsNonRoot and image has non-numeric user (nonroot), cannot verify user is non-root (pod: "miniflux-97cc5955f-pt7vf_miniflux(d1c56d29-ea0a-407c-b3f3-9821fbd7ee61)", container: miniflux)
```
This commit is contained in:
Sheogorath 2024-02-05 01:11:53 +01:00 committed by Frédéric Guillot
parent 7d9f174b3f
commit 552fb3e4cc
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
packaging/docker/distroless/Dockerfile
View file

@ -7,7 +7,7 @@ RUN go build \
-ldflags="-s -w -X 'miniflux.app/v2/internal/version.Version=`git describe --tags --abbrev=0`' -X 'miniflux.app/v2/internal/version.Commit=`git rev-parse --short HEAD`' -X 'miniflux.app/v2/internal/version.BuildDate=`date +%FT%T%z`'" \ -ldflags="-s -w -X 'miniflux.app/v2/internal/version.Version=`git describe --tags --abbrev=0`' -X 'miniflux.app/v2/internal/version.Commit=`git rev-parse --short HEAD`' -X 'miniflux.app/v2/internal/version.BuildDate=`date +%FT%T%z`'" \
main.go main.go
FROM gcr.io/distroless/base FROM gcr.io/distroless/base:nonroot
LABEL org.opencontainers.image.title=Miniflux LABEL org.opencontainers.image.title=Miniflux
LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader" LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader"
@ -20,5 +20,4 @@ LABEL org.opencontainers.image.documentation=https://miniflux.app/docs/
EXPOSE 8080 EXPOSE 8080
ENV LISTEN_ADDR 0.0.0.0:8080 ENV LISTEN_ADDR 0.0.0.0:8080
COPY --from=build /go/src/app/miniflux /usr/bin/miniflux COPY --from=build /go/src/app/miniflux /usr/bin/miniflux
USER nonroot:nonroot
CMD ["/usr/bin/miniflux"] CMD ["/usr/bin/miniflux"]