From 6cf5928ff1ee2f9d21662d74057f3a8331ddedfb Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Sun, 8 Nov 2015 16:34:32 -0500 Subject: Base image changes for drop-root The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root --- docker/base/Dockerfile.j2 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docker/base/Dockerfile.j2') diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index 76e74bbd9..52ff28edb 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -167,7 +167,10 @@ RUN apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com 199369E5404BD COPY set_configs.py /usr/local/bin/kolla_set_configs COPY start.sh /usr/local/bin/kolla_start +COPY sudoers /etc/sudoers RUN touch /usr/local/bin/kolla_extend_start \ - && chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs + && chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs \ + && chmod 440 /etc/sudoers \ + && groupadd kolla CMD ["kolla_start"] -- cgit v1.2.3