Drop root for nova

Updates to ensure commands run in the nova containers
are done as the 'nova' user rather than root.

Change-Id: I0dd0276c2848ad77d92d350dfa0f20161329ed55
Partially-Implements: blueprint drop-root

11 files changed, 21 insertions, 1 deletions

diff --git a/docker/nova/nova-api/Dockerfile.j2 b/docker/nova/nova-api/Dockerfile.j2
index bd5270ac6..ef5fd1b44 100644
--- a/docker/nova/nova-api/Dockerfile.j2
+++ b/docker/nova/nova-api/Dockerfile.j2
@@ -14,3 +14,5 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-api/extend_start.sh b/docker/nova/nova-api/extend_start.sh
index 9b0e9d746..93b63d53f 100644
--- a/docker/nova/nova-api/extend_start.sh
+++ b/docker/nova/nova-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    sudo -H -u nova nova-manage db sync
+    nova-manage db sync
     exit 0
 fi
diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2
index 4b2fea8b4..3b48ff1fd 100644
--- a/docker/nova/nova-base/Dockerfile.j2
+++ b/docker/nova/nova-base/Dockerfile.j2
@@ -42,3 +42,5 @@ RUN ln -s nova-base-source/* nova \
     && chown -R nova: /etc/nova /var/log/nova /home/nova
 
 {% endif %}
+
+RUN usermod -a -G kolla nova
diff --git a/docker/nova/nova-compute/Dockerfile.j2 b/docker/nova/nova-compute/Dockerfile.j2
index 90dd8de2e..40dfdf862 100644
--- a/docker/nova/nova-compute/Dockerfile.j2
+++ b/docker/nova/nova-compute/Dockerfile.j2
@@ -39,3 +39,5 @@ RUN /var/lib/kolla/venv/bin/pip install --no-cache-dir libvirt-python
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-conductor/Dockerfile.j2 b/docker/nova/nova-conductor/Dockerfile.j2
index d1b5ddcea..effb7a120 100644
--- a/docker/nova/nova-conductor/Dockerfile.j2
+++ b/docker/nova/nova-conductor/Dockerfile.j2
@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-conductor \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-consoleauth/Dockerfile.j2 b/docker/nova/nova-consoleauth/Dockerfile.j2
index f12983140..427144f01 100644
--- a/docker/nova/nova-consoleauth/Dockerfile.j2
+++ b/docker/nova/nova-consoleauth/Dockerfile.j2
@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-console \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-libvirt/Dockerfile.j2 b/docker/nova/nova-libvirt/Dockerfile.j2
index de4499c65..d6eb7fd36 100644
--- a/docker/nova/nova-libvirt/Dockerfile.j2
+++ b/docker/nova/nova-libvirt/Dockerfile.j2
@@ -33,3 +33,5 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-network/Dockerfile.j2 b/docker/nova/nova-network/Dockerfile.j2
index 5d9ec3fc7..e0624fb63 100644
--- a/docker/nova/nova-network/Dockerfile.j2
+++ b/docker/nova/nova-network/Dockerfile.j2
@@ -21,3 +21,5 @@ RUN yum -y install initscripts \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-novncproxy/Dockerfile.j2 b/docker/nova/nova-novncproxy/Dockerfile.j2
index 402d68532..d216895f3 100644
--- a/docker/nova/nova-novncproxy/Dockerfile.j2
+++ b/docker/nova/nova-novncproxy/Dockerfile.j2
@@ -18,3 +18,5 @@ RUN cd /usr/share && ln -s nova-novncproxy-source/* novnc
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-scheduler/Dockerfile.j2 b/docker/nova/nova-scheduler/Dockerfile.j2
index cd6e9b1c6..0057a7cd9 100644
--- a/docker/nova/nova-scheduler/Dockerfile.j2
+++ b/docker/nova/nova-scheduler/Dockerfile.j2
@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-scheduler \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova
diff --git a/docker/nova/nova-spicehtml5proxy/Dockerfile.j2 b/docker/nova/nova-spicehtml5proxy/Dockerfile.j2
index 6c95ddcaf..046277662 100644
--- a/docker/nova/nova-spicehtml5proxy/Dockerfile.j2
+++ b/docker/nova/nova-spicehtml5proxy/Dockerfile.j2
@@ -16,3 +16,5 @@ RUN cd /usr/share && ln -s nova-spicehtml5proxy-source/* spice-html5
 {% endif %}
 
 {{ include_footer }}
+
+USER nova