🚨 Jira Linter Failed

Commit: 33d68c0
Failed at: 2026-04-15 10:51:36 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to validate branch and PR title rules: branch name 'hotfix/fix-nonroot-permissions-release-5.12' must contain a valid Jira ticket ID (e.g., ABC-123)

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

This pull request addresses a file permission issue in the distroless Docker image that occurs when running the container as a non-root user. It fixes a permission denied error that prevented the gateway from creating directories, specifically for middleware bundles.

The fix involves adding the --chown=65532:65532 flag to the COPY instruction in ci/Dockerfile.distroless. This ensures that the /opt/tyk-gateway directory and its contents are owned by the non-root user (UID 65532) defined in the base image, allowing the application to have the necessary write permissions at runtime.

Files Changed Analysis

• ci/Dockerfile.distroless: A single-line modification to a COPY command to set file ownership.

Architecture & Impact Assessment

• What this PR accomplishes: Enables the Tyk Gateway distroless Docker container to run securely as a non-root user, which is a critical security best practice, especially in container orchestration platforms like Kubernetes.
• Key technical changes introduced: The use of the --chown flag in the Dockerfile to set the user and group ownership of the application files during the image build process.
• Affected system components: The change is isolated to the build process of the distroless Docker image. It positively impacts the runtime environment for users of this image by resolving a critical permission bug without altering any application code.

Scope Discovery & Context Expansion

• The change is highly localized to the distroless Docker image configuration. Its impact, however, is significant for users deploying Tyk in environments that enforce non-root execution policies.
• The UID 65532 is a standard convention for the nonroot user in distroless base images, making this a robust fix.
• No other parts of the application or other Docker build configurations are affected.

Powered by Visor from Probelabs

Last updated: 2026-04-15T10:52:09.754Z | Triggered by: pr_opened | Commit: 33d68c0

💡 TIP: You can chat with Visor using /visor ask <your question>

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Quality Issues (1)

ARG NONROOT_UID=65532
ARG NONROOT_GID=65532

...

COPY --chown=${NONROOT_UID}:${NONROOT_GID} --from=deb /opt/tyk-gateway /opt/tyk-gateway

Powered by Visor from Probelabs

Last updated: 2026-04-15T10:52:08.495Z | Triggered by: pr_opened | Commit: 33d68c0

💡 TIP: You can chat with Visor using /visor ask <your question>

API Changes

no api changes detected