Skip to content

Security hardening: run services as non-root user#916

Open
Dev10-sys wants to merge 3 commits into
repository-service-tuf:mainfrom
Dev10-sys:hardening-non-root-user
Open

Security hardening: run services as non-root user#916
Dev10-sys wants to merge 3 commits into
repository-service-tuf:mainfrom
Dev10-sys:hardening-non-root-user

Conversation

@Dev10-sys

Copy link
Copy Markdown

This change updates the containers to run as a non-root user instead of root.

Summary of changes:

  • Created a dedicated user named tuf (UID 1000) inside the containers
  • Updated file and directory permissions so the tuf user can access required paths
  • Changed internal service ports from 80 to 8080 so root privileges are not required
  • Updated container and deployment configuration to enforce non-root execution
  • Adjusted supervisor configuration for worker to use writable directories
  • Updated Helm charts to set securityContext with runAsNonRoot

Why this change:
Running containers as root is not recommended for security reasons. Running as a non-root user follows container security best practices and reduces risk in production environments.

Testing:
The configuration was verified to ensure the API and Worker can start under non-root permissions and the container setup remains consistent with docker-compose and Helm deployment.

This change is coordinated with the umbrella repository PR:
repository-service-tuf/repository-service-tuf#934

@Dev10-sys Dev10-sys force-pushed the hardening-non-root-user branch from e4aa635 to 7ce0970 Compare April 5, 2026 14:15
Signed-off-by: Dev10-sys <kalpanagola9897@gmail.com>
@Dev10-sys Dev10-sys force-pushed the hardening-non-root-user branch from 7ce0970 to 723fe12 Compare April 5, 2026 16:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant