Skip to content

Commit 0d767d7

Browse files
torstenwalterdiemol
authored andcommitted
Support Arbitrary User IDs for OpenShift (#787)
To quote from the official [OpenShift documentation](https://docs.openshift.com/container-platform/3.9/creating_images/guidelines.html): > By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node. > For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group. Files to be executed should also have group execute permissions. With this change it should be possible to run the Selenium images on OpenShift without further modifications.
1 parent 2087bff commit 0d767d7

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

Base/Dockerfile

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ RUN useradd seluser \
4747
&& usermod -a -G sudo seluser \
4848
&& echo 'ALL ALL = (ALL) NOPASSWD: ALL' >> /etc/sudoers \
4949
&& echo 'seluser:secret' | chpasswd
50+
ENV HOME=/home/seluser
5051

5152
#=======================================
5253
# Create shared / common bin directory
@@ -71,4 +72,6 @@ USER seluser
7172
RUN sudo mkdir -p /opt/selenium \
7273
&& sudo chown seluser:seluser /opt/selenium \
7374
&& wget --no-verbose https://selenium-release.storage.googleapis.com/3.14/selenium-server-standalone-3.14.0.jar \
74-
-O /opt/selenium/selenium-server-standalone.jar
75+
-O /opt/selenium/selenium-server-standalone.jar \
76+
&& sudo chgrp -R 0 /opt/selenium $HOME \
77+
&& sudo chmod -R g=u /opt/selenium $HOME

0 commit comments

Comments
 (0)