Do not run as root, for security reasons

Icinga · May 22, 2024 · 6048123 · 6048123
1 parent 230491b
commit 6048123
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 0 deletions.
diff --git a/Containerfile b/Containerfile
@@ -9,6 +9,8 @@ RUN CGO_ENABLED=0 GOOS=linux go build -o /icinga-kubernetes cmd/icinga-kubernete
 
 FROM scratch
 
+COPY /rootfs/ /
 COPY --from=build /icinga-kubernetes /icinga-kubernetes
 
+USER icinga-kubernetes
 CMD ["/icinga-kubernetes"]
diff --git a/rootfs/etc/group b/rootfs/etc/group
@@ -0,0 +1 @@
+icinga-kubernetes:x:101:
diff --git a/rootfs/etc/passwd b/rootfs/etc/passwd
@@ -0,0 +1 @@
+icinga-kubernetes:*:101:101::/nonexistent:/usr/sbin/nologin