Why does buildpack task require privileged?

[kscherer]

I would love to integrate the buildpack tekton tasks into our pipelines but the use of privileged access isn't going to get past our security review.

https://github.com/buildpacks/tekton-integration/blob/main/task/buildpacks/0.3/buildpacks.yaml#L118

Is it required for the chown? I am using the kaniko task and it uses runAsUser: 0 but not privileged. Ideally it would be possible to build images without any elevated permissions.

[GijsvanDulmen]

We had the same question! :-)

[jromero]

Some context here:

Links:

• https://tektoncd.slack.com/archives/CK9JGKS20/p1641975644014700
• Buildpacks task fails on OpenShift tektoncd/catalog#197
• Remove securityContext from buildpacks task tektoncd/catalog#899

[zroubalik]

This has been fixed in https://github.com/tektoncd/catalog/blob/main/task/buildpacks/0.4/buildpacks.yaml, I think we can close this issue.