Backport RHEL 8 and 9 RPM builds to 0.4 release stream - #570
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| ARG GO_IMAGE | ||
| ARG DISTRO=aepifanov/centos7.vault | ||
| ARG SUITE=latest | ||
| ARG DISTRO=almalinux | ||
| ARG SUITE=9 | ||
| ARG BUILD_IMAGE=${DISTRO}:${SUITE} | ||
|
|
||
| FROM ${GO_IMAGE} AS golang | ||
|
|
||
| FROM ${BUILD_IMAGE} | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| ENV GOPROXY=direct | ||
| ENV GOPATH=/go | ||
| ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin | ||
| ENV AUTO_GOPATH 1 | ||
| ENV DOCKER_BUILDTAGS seccomp selinux | ||
| ENV RUNC_BUILDTAGS seccomp selinux | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| RUN yum install -y rpm-build rpmlint yum-utils | ||
| RUN dnf config-manager --set-enabled powertools | ||
| # Enable CodeReady Builder repository to get device-mapper-devel and glibc-static. | ||
| RUN dnf config-manager --set-enabled crb | ||
| COPY SPECS /root/rpmbuild/SPECS | ||
| # Overwrite repo that was failing on aarch64 | ||
| RUN yum-builddep -y /root/rpmbuild/SPECS/*.spec | ||
| COPY --from=golang /usr/local/go /usr/local/go | ||
| COPY --from=golang /usr/local/go /usr/local/go/ | ||
| WORKDIR /root/rpmbuild | ||
| ENTRYPOINT ["/bin/rpmbuild"] |
There was a problem hiding this comment.
Docker container runs as default root user - medium severity
By default, containers are run with root privileges and also run as the root user inside the container. Running the app as root gives a hacker who was able to hack the application instant root access to the Docker host, which could help them to escalate a hack.
Show fix
Remediation: Add 'USER username' to the end of your file.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| ARG GO_IMAGE | ||
| ARG DISTRO=centos | ||
| ARG DISTRO=almalinux | ||
| ARG SUITE=8 | ||
| ARG BUILD_IMAGE=${DISTRO}:${SUITE} | ||
|
|
||
| FROM ${GO_IMAGE} AS golang | ||
|
|
||
| FROM ${BUILD_IMAGE} | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO ${DISTRO} | ||
| ENV SUITE ${SUITE} | ||
| ENV GOPROXY=direct | ||
| ENV GOPATH=/go | ||
| ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin | ||
| ENV AUTO_GOPATH 1 | ||
| ENV DOCKER_BUILDTAGS seccomp selinux | ||
| ENV RUNC_BUILDTAGS seccomp selinux | ||
| ARG DISTRO | ||
| ARG SUITE | ||
| ENV DISTRO=${DISTRO} | ||
| ENV SUITE=${SUITE} | ||
| RUN yum install -y rpm-build rpmlint yum-utils | ||
| # Enable PowerTools repository to get device-mapper-devel and glibc-static. | ||
| RUN dnf config-manager --set-enabled powertools | ||
| COPY SPECS /root/rpmbuild/SPECS | ||
| # Overwrite repo that was failing on aarch64 | ||
| RUN yum-builddep -y /root/rpmbuild/SPECS/*.spec | ||
| COPY --from=golang /usr/local/go /usr/local/go | ||
| COPY --from=golang /usr/local/go /usr/local/go/ | ||
| WORKDIR /root/rpmbuild | ||
| ENTRYPOINT ["/bin/rpmbuild"] |
There was a problem hiding this comment.
Docker container runs as default root user - medium severity
By default, containers are run with root privileges and also run as the root user inside the container. Running the app as root gives a hacker who was able to hack the application instant root access to the Docker host, which could help them to escalate a hack.
Show fix
Remediation: Add 'USER username' to the end of your file.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
2 participants
We're interested in taking the 0.4.x release stream of cri-dockerd and would like RHEL 8 and 9 RPM builds from the project - #524 achieved this on master, #550 backported it to 0.3.x, and now we'd like it in 0.4.x too. This PR simply cherry-picks those changes (edc762a) into the release/0.4 branch so that RPMs for these distributions are available for 0.4.x builds.
Please see the original PR #524 for details on implementation.