Warn on uid/gid == 0 (#4374)

Signed-off-by: Anders Eknert <anders@eknert.com>

Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>

Dockerfile

@@ -8,6 +8,11 @@ FROM ${BASE}
 
 LABEL org.opencontainers.image.authors="Torin Sandall <torinsandall@gmail.com>"
 
+# Temporarily allow us to identify whether running from within an offical
+# Docker image, so that we may print a warning when uid or gid == 0 (root)
+# Remove once https://github.com/open-policy-agent/opa/issues/4295 is done
+ENV OPA_DOCKER_IMAGE="official"
+
 # Any non-zero number will do, and unfortunately a named user will not, as k8s
 # pod securityContext runAsNonRoot can't resolve the user ID:
 # https://github.com/kubernetes/kubernetes/issues/40958. Make root (uid 0) when

runtime/runtime.go

@@ -15,6 +15,7 @@ import (
 	mr "math/rand"
 	"os"
 	"os/signal"
+	"os/user"
 	"strings"
 	"sync"
 	"syscall"
@@ -397,6 +398,17 @@ func (rt *Runtime) Serve(ctx context.Context) error {
 		rt.logger.Error("Token authentication enabled without authorization. Authentication will be ineffective. See https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization for more information.")
 	}
 
+	usr, err := user.Current()
+	if err != nil {
+		rt.logger.Debug("Failed to determine uid/gid of process owner")
+	} else if usr.Uid == "0" || usr.Gid == "0" {
+		message := "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
+		if os.Getenv("OPA_DOCKER_IMAGE") == "official" {
+			message += " Use the -rootless image to avoid running with root privileges. This will be made the default in later OPA releases."
+		}
+		rt.logger.Warn(message)
+	}
+
 	// NOTE(tsandall): at some point, hopefully we can remove this because the
 	// Go runtime will just do the right thing. Until then, try to set
 	// GOMAXPROCS based on the CPU quota applied to the process.