-
Notifications
You must be signed in to change notification settings - Fork 354
Backport RHEL 8 and 9 RPM builds to 0.4 release stream #570
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: release/0.4
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
This file was deleted.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,4 +18,4 @@ make fedora | |
| ## Specifying a specific distro version | ||
| ```shell | ||
| make fedora-25 | ||
| ``` | ||
| ``` | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,26 @@ | ||
| ARG GO_IMAGE | ||
| ARG DISTRO=centos | ||
| ARG DISTRO=almalinux | ||
| ARG SUITE=8 | ||
| ARG BUILD_IMAGE=${DISTRO}:${SUITE} | ||
|
|
||
| FROM ${GO_IMAGE} AS golang | ||
|
|
||
| FROM ${BUILD_IMAGE} | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO ${DISTRO} | ||
| ENV SUITE ${SUITE} | ||
| ENV GOPROXY=direct | ||
| ENV GOPATH=/go | ||
| ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin | ||
| ENV AUTO_GOPATH 1 | ||
| ENV DOCKER_BUILDTAGS seccomp selinux | ||
| ENV RUNC_BUILDTAGS seccomp selinux | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| RUN yum install -y rpm-build rpmlint yum-utils | ||
| # Enable PowerTools repository to get device-mapper-devel and glibc-static. | ||
| RUN dnf config-manager --set-enabled powertools | ||
| COPY SPECS /root/rpmbuild/SPECS | ||
| # Overwrite repo that was failing on aarch64 | ||
| RUN yum-builddep -y /root/rpmbuild/SPECS/*.spec | ||
| COPY --from=golang /usr/local/go /usr/local/go | ||
| COPY --from=golang /usr/local/go /usr/local/go/ | ||
| WORKDIR /root/rpmbuild | ||
| ENTRYPOINT ["/bin/rpmbuild"] | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,26 @@ | ||
| ARG GO_IMAGE | ||
| ARG DISTRO=aepifanov/centos7.vault | ||
| ARG SUITE=latest | ||
| ARG DISTRO=almalinux | ||
| ARG SUITE=9 | ||
| ARG BUILD_IMAGE=${DISTRO}:${SUITE} | ||
|
|
||
| FROM ${GO_IMAGE} AS golang | ||
|
|
||
| FROM ${BUILD_IMAGE} | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| ENV GOPROXY=direct | ||
| ENV GOPATH=/go | ||
| ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin | ||
| ENV AUTO_GOPATH 1 | ||
| ENV DOCKER_BUILDTAGS seccomp selinux | ||
| ENV RUNC_BUILDTAGS seccomp selinux | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| RUN yum install -y rpm-build rpmlint yum-utils | ||
| RUN dnf config-manager --set-enabled powertools | ||
| # Enable CodeReady Builder repository to get device-mapper-devel and glibc-static. | ||
| RUN dnf config-manager --set-enabled crb | ||
| COPY SPECS /root/rpmbuild/SPECS | ||
| # Overwrite repo that was failing on aarch64 | ||
| RUN yum-builddep -y /root/rpmbuild/SPECS/*.spec | ||
| COPY --from=golang /usr/local/go /usr/local/go | ||
| COPY --from=golang /usr/local/go /usr/local/go/ | ||
| WORKDIR /root/rpmbuild | ||
| ENTRYPOINT ["/bin/rpmbuild"] | ||
|
Comment on lines
1
to
26
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Docker container runs as default root user - medium severity Show fixRemediation: Add 'USER username' to the end of your file. Reply |
||
This file was deleted.
This file was deleted.
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Docker container runs as default root user - medium severity
By default, containers are run with root privileges and also run as the root user inside the container. Running the app as root gives a hacker who was able to hack the application instant root access to the Docker host, which could help them to escalate a hack.
Show fix
Remediation: Add 'USER username' to the end of your file.
Reply
@AikidoSec ignore: [REASON]to ignore this issue.More info