mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-21 07:51:19 -06:00
Ashutosh Narkar
f2199ab372
Since all published OPA images now run with a non-root uid/gid, there is no need to publish the rootless image tag. Currently if the rootless variant is run, a log message at the Warn level is printed. This change increaes the log level for that message to Error in order to make it more explict to stop using this variant in the future. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
30 lines
870 B
Go
30 lines
870 B
Go
// Copyright 2022 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package runtime
|
|
|
|
import (
|
|
"os"
|
|
"os/user"
|
|
|
|
"github.com/open-policy-agent/opa/logging"
|
|
)
|
|
|
|
// checkUserPrivileges on Linux could be running in Docker, so we check if
|
|
// we're running in the official container image.
|
|
func checkUserPrivileges(logger logging.Logger) {
|
|
usr, err := user.Current()
|
|
if err != nil {
|
|
logger.Debug("Failed to determine uid/gid of process owner")
|
|
} else if usr.Uid == "0" || usr.Gid == "0" {
|
|
message := "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
|
|
logger.Warn(message)
|
|
}
|
|
|
|
if os.Getenv("OPA_DOCKER_IMAGE_TAG") == "rootless" {
|
|
message := "The -rootless image tag will not be published after OPA v0.52.0."
|
|
logger.Error(message)
|
|
}
|
|
}
|