Comments (7)
From @smothiki on May 19, 2016 18:4
@krancour I think we are running as a non root user ?
from builder.
From @krancour on May 20, 2016 3:37
Does not seem it:
[kent@mbp ~]$ k exec -it deis-builder-5qn00 -- bash
bash-4.3# whoami
root
But let's hold off on doing anything with this until after the Dockerfile's been refactored for Ubuntu Slim-- which I am working on. Otherwise, there's just going to be an unresolvable merge conflict and we'll make extra work for ourselves.
from builder.
From @bacongobbler on May 20, 2016 4:57
Yeah I think openssh is running as root in order to bind to port 22.
from builder.
From @smothiki on May 23, 2016 22:43
@krancour I think the new ubuntu slim image is not running builder as root . Let me know if this isn;t fixed
from builder.
From @arschles on May 24, 2016 20:0
bumping from RC1, as this is not critical for the RC
from builder.
From @krancour on May 24, 2016 20:2
That's fine.
from builder.
From @bacongobbler on May 31, 2016 17:55
The server itself is still running as root, so this is not yet resolved. All processes should be run as non-root. If any of them are compromised, the user has root level access and could break out of the container onto the host.
root@deis-builder-ef12k:/# ps faux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 15 1.0 0.0 18288 3360 ? Ss 17:53 0:00 bash
root 25 0.0 0.0 34428 2808 ? R+ 17:53 0:00 \_ ps faux
root 1 0.1 0.2 224688 23076 ? Ssl 17:52 0:00 /usr/bin/boot s
from builder.
Related Issues (20)
- s2i (source2image) builder HOT 1
- builder should also support password callback HOT 1
- Make docker socket path configurable
- Add package level godoc
- Proposal: send logs directly from builder pods back to builder pod HOT 5
- Allow git pushes to respond with an informative failure message
- Have probes ping the SSH server HOT 1
- Use a cheaper way to ping the Kubernetes API in the health check endpoint HOT 2
- sign tarballs and compiled slugs HOT 1
- [META] Future runner capabilities HOT 3
- [META] Future build pipeline
- List of issues with running 2 or more builder pods in a cluster
- Allow namespacing of private registry images
- Add CURL variables to slugbuilder appConfig k8s_util
- Release phase HOT 1
- [ERROR] Failed handshake: read tcp ...
- Pushing any app without env variables fails HOT 2
- Add a test for #49 - BUILDPACK_URL
- Builder fails to resolve host HOT 16
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from builder.