Skip to content

moving the fat jar to /opt/openshift is a not a good idea #13

Open
@der-ali

Description

@der-ali

By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node.

For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group. Files to be executed should also have group execute permissions.
This is actually implemented out of the box in the base image (centos/s2i-base-centos7) for the directory /opt/app-root/src. You can check that the last line tin /etc/passwd default:x:1001:0:Default Application User:/opt/app-root/src:/sbin/nologin
when you move thought the jar to /opt/openshift you are losing this feature

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions