Skip to content

[TT-17009] make Docker images backward compatible with runAsUser: 1000 #8104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buger merged 1 commit into from
Apr 20, 2026
+7 −2
Merged

[TT-17009] make Docker images backward compatible with runAsUser: 1000 #8104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,7 @@ jobs:
build-args: |
BUILD_PACKAGE_NAME=tyk-gateway-fips
BASE_IMAGE=tykio/dhi-busybox:1.37-fips
NONROOT_CHOWN=true
- name: Docker metadata for fips tag push
id: tag_metadata_fips
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
Expand Down Expand Up @@ -276,6 +277,7 @@ jobs:
build-args: |
BUILD_PACKAGE_NAME=tyk-gateway-fips
BASE_IMAGE=tykio/dhi-busybox:1.37-fips
NONROOT_CHOWN=true
- name: Attach base image VEX to fips
if: ${{ matrix.golang_cross == '1.25-bullseye' && startsWith(github.ref, 'refs/tags') }}
run: |
Expand Down
7 changes: 5 additions & 2 deletions ci/Dockerfile.distroless
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,14 @@

# The _ after the pkg name is to match tyk-gateway strictly and not tyk-gateway-fips (for example)
COPY ${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb /
RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb
ARG NONROOT_CHOWN=false
RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb \
&& chmod -R a+rX /opt/tyk-gateway/ \

Check warning on line 15 in ci/Dockerfile.distroless

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The `chmod -R a+rX` command is executed for all builds, including FIPS builds where a `chown -R` is also performed. If the container for a FIPS build is run as user `65532`, which now owns the files, the global read/execute permissions from `chmod` are likely redundant. This results in an unnecessary recursive filesystem traversal during the image build, slowing down the build process for FIPS images.
Raw output 
Restructure the logic to only apply the necessary permissions for each case. For FIPS builds (`NONROOT_CHOWN=true`), the `chown` command should be sufficient. For non-FIPS builds, the `chmod` is needed for compatibility. This avoids running two recursive filesystem operations when one is sufficient.

Check warning on line 15 in ci/Dockerfile.distroless

View check run for this annotation

probelabs / Visor: security

security Issue 

The command `chmod -R a+rX /opt/tyk-gateway/` makes all files in the application directory world-readable. While this enables running the container with an arbitrary user ID, it weakens in-container security. If a vulnerability allows an attacker to execute code as any user within the container, they will be able to read all application files, including configuration files. This could potentially expose sensitive information if any is present.
Raw output 
Consider using a more restrictive permission model if possible. For example, if the container is meant to run with a user from a specific group (like the `root` group, GID 0, which is common in some container platforms), you could change file ownership to `root:<gid>` and set group-readable permissions (`chmod -R g+rX`). This would be more secure than world-readable permissions. If supporting truly arbitrary user IDs is a hard requirement, the current approach may be an acceptable trade-off.
&& if [ "$NONROOT_CHOWN" = "true" ]; then chown -R 65532:65532 /opt/tyk-gateway/; fi

Check warning on line 16 in ci/Dockerfile.distroless

View check run for this annotation

probelabs / Visor: architecture

architecture Issue 

The UID/GID `65532` is hardcoded in the `chown` command. While this is the standard 'nonroot' user in distroless images, it's better practice to define it as a build argument for clarity and maintainability, especially since it was also used in the now-removed `COPY --chown` instruction.
Raw output 
Define an `ARG` for the non-root UID near the top of the Dockerfile and use this variable in the `chown` command. This makes the value explicit and easier to change if needed in the future.

FROM ${BASE_IMAGE}

COPY --chown=65532:65532 --from=deb /opt/tyk-gateway /opt/tyk-gateway
COPY --from=deb /opt/tyk-gateway /opt/tyk-gateway

ARG PORTS
EXPOSE $PORTS
Expand Down
Loading