Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure Dockerfile for OpenShift restricted security context #492

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

abimichel
Copy link
Collaborator

Description

When MALS 2 is deployed to OpenShift, the pod security context and container security context default to 'restricted'.

With Kubernetes restricted security context:

  • Pods cannot run as privileged
  • Pods cannot mount host directory volumes
  • Requires that a pod is run as a user in a pre-allocated range of UIDs
  • Requires that a pod is run with a pre-allocated Multi-Category Security (MCS) label

More info: OpenShift Security Context Documentation

Types of changes

Removes use of root user and 1001 user from Dockerfile, as it is suspected that this is causing issues when MALS 2 pods restart (e.g. during Platform upgrades).

Checklist

  • [ x] I have read the CONTRIBUTING doc
  • I have checked that unit tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate

@abimichel abimichel requested a review from barrfalk as a code owner December 24, 2024 23:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant