mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Ashutosh Narkar
5c183f5ecb
Currently all OPA image variants except "rootless" use uid/gid 0 (i.e. root). Per container security best practices it is better to run as non-root. So now OPA defaults to non-root uid/gid in images. If root user if needed, it can be explicitly set. The "rootless" image variant is no longer needed and will be not published in future releases. Also currently the debug variant is published for `linux/amd64` platform. For `linux/arm64` only static images are generated. The debug variant can be useful for debugging purposes and hence this change adds that to the static image which can then be used on amd64 and arm64 arch. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
34 lines
891 B
Go
34 lines
891 B
Go
// Copyright 2022 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package runtime
|
|
|
|
import (
|
|
"os"
|
|
"os/user"
|
|
|
|
"github.com/open-policy-agent/opa/logging"
|
|
)
|
|
|
|
// checkUserPrivileges on Linux could be running in Docker, so we check if
|
|
// we're running in the official container image.
|
|
func checkUserPrivileges(logger logging.Logger) {
|
|
var message string
|
|
|
|
usr, err := user.Current()
|
|
if err != nil {
|
|
logger.Debug("Failed to determine uid/gid of process owner")
|
|
} else if usr.Uid == "0" || usr.Gid == "0" {
|
|
message = "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
|
|
}
|
|
|
|
if os.Getenv("OPA_DOCKER_IMAGE_TAG") == "rootless" {
|
|
message += " The -rootless image tag will not be published after OPA v0.50.0."
|
|
}
|
|
|
|
if message != "" {
|
|
logger.Warn(message)
|
|
}
|
|
}
|