Change wfengigne pod startup to non root

Change-Id: I15295be19b31d5ca8b757d171cc6afc4dca1e72e
Issue-ID: VFC-1637
Signed-off-by: yangyan <yangyanyj@chinamobile.com>

diff --git a/activiti-extension/src/main/docker/Dockerfile b/activiti-extension/src/main/docker/Dockerfile
index 6a5bed4..dd207cd 100644 (file)
--- a/activiti-extension/src/main/docker/Dockerfile
+++ b/activiti-extension/src/main/docker/Dockerfile
@@ -5,15 +5,18 @@ WORKDIR /home/onap/workflow/wfengineactiviti
 EXPOSE 8080
 
 RUN apk add --update curl && \
+    apk --no-cache add sudo && \
+    addgroup -g 1000 -S onap && \
+    adduser onap -D -G onap -u 1000 && \
+    chmod u+w /etc/sudoers && \
+    sed -i '/User privilege/a\\onap    ALL=(ALL:ALL) NOPASSWD:ALL' /etc/sudoers && \
+    chmod u-x /etc/sudoers && \
     rm -rf /var/cache/apk/*
 
 ADD apache-tomcat /home/onap/workflow/wfengineactiviti/
-RUN chmod 755 /home/onap/workflow/wfengineactiviti/bin/*.sh
+RUN chmod 755 /home/onap/workflow/wfengineactiviti/bin/*.sh && chown onap:onap -R /home/onap
 
-ENTRYPOINT ["./bin/entrypoint.sh"]  
+USER onap
+WORKDIR /home/onap/workflow/wfengineactiviti
+ENTRYPOINT ["./bin/entrypoint.sh"]
 CMD ["start"]
-
-
-
-
-

diff --git a/wfenginemgrservice/src/main/docker/Dockerfile b/wfenginemgrservice/src/main/docker/Dockerfile
index 5ca819b..7c5e8e9 100644 (file)
--- a/wfenginemgrservice/src/main/docker/Dockerfile
+++ b/wfenginemgrservice/src/main/docker/Dockerfile
@@ -5,11 +5,17 @@ WORKDIR /home/onap/workflow/wfenginemgrservice
 EXPOSE 10550\r
 \r
 RUN apk add --update curl && \\r
+    apk --no-cache add sudo && \\r
+    addgroup -g 1000 -S onap && \\r
+    adduser cmcc -D -G onap -u 1000 && \\r
+    chmod u+w /etc/sudoers && \\r
+    sed -i '/User privilege/a\\cmcc    ALL=(ALL:ALL) NOPASSWD:ALL' /etc/sudoers && \\r
+    chmod u-x /etc/sudoers && \\r
     rm -rf /var/cache/apk/*\r
 \r
 ADD bin /home/onap/workflow/wfenginemgrservice/\r
-RUN chmod 755 /home/onap/workflow/wfenginemgrservice/*.sh\r
-\r
-ENTRYPOINT ["./entrypoint.sh"]  \r
+RUN chmod 755 /home/onap/workflow/wfenginemgrservice/*.sh && chown onap:onap -R /home/onap\r
+USER onap\r
+WORKDIR /home/onap/workflow/wfenginemgrservice\r
+ENTRYPOINT ["./entrypoint.sh"]\r
 CMD ["start"]\r
-\r