From bbe7efa2068e0d5393abc2a0240814ef18960786 Mon Sep 17 00:00:00 2001 From: rajeevme Date: Tue, 23 Jul 2019 12:36:49 +0530 Subject: [PATCH] [AAI-2177] Run container process as non-root Issue-ID: AAI-2177 Change-Id: Id4b922ee1fb8cf36ea22d84849fc0192651ff7ab Signed-off-by: rajeevme (cherry picked from commit 0c5c2a39ab3fb5aa54e0e70699a23db08455fcbe) --- src/main/docker/Dockerfile | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/main/docker/Dockerfile b/src/main/docker/Dockerfile index c99d763..343ed4d 100644 --- a/src/main/docker/Dockerfile +++ b/src/main/docker/Dockerfile @@ -22,6 +22,22 @@ COPY *.sh $BIN_HOME COPY bundleconfig-local $MICRO_HOME/bundleconfig COPY bundleconfig-local/etc/logback.xml $MICRO_HOME/bundleconfig/etc RUN chmod 755 $BIN_HOME/* + +# Changes related to:AAI-2177 +# Change aai gizmo container processes to run as non-root on the host + +#Note:The group id and user id used below (492382 & 341790 respectively) are chosen arbitarily based on assumption that +# these are not used elsewhere. Please see https://jira.onap.org/browse/AAI-2172 for more background on this. + +RUN mkdir /opt/aaihome && \ + groupadd -g 492382 aaiadmin && \ + useradd -r -u 341790 -g 492382 -ms /bin/sh -d /opt/aaihome/aaiadmin aaiadmin && \ + chown -R aaiadmin:aaiadmin $MICRO_HOME &&\ + mkdir /logs && \ + chown -R aaiadmin:aaiadmin /logs + +USER aaiadmin + RUN ln -s /logs $MICRO_HOME/logs EXPOSE 9520 9520 -- 2.16.6