Skip to content

Commit 8327aa0

Browse files
authored
ci: Use non-root user in Docker when running codegen (#31)
* Run Docker in CI as non-root user * Make useradd line a little less clever
1 parent c8fdca2 commit 8327aa0

File tree

3 files changed

+33
-8
lines changed

3 files changed

+33
-8
lines changed

.buildkite/Dockerfile

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,32 @@
11
ARG NODE_VERSION=${NODE_VERSION:-18}
22
FROM node:$NODE_VERSION
33

4+
ARG BUILDER_USER=1000
5+
ARG BUILDER_GROUP=1000
6+
47
# Install zip util
58
RUN apt-get clean -y && \
6-
apt-get -qy update && \
7-
apt-get -y install zip && \
8-
apt-get clean && \
9-
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
9+
apt-get update -y && \
10+
apt-get install -y zip
11+
12+
# Set up all files as owned by non-root user
13+
RUN groupadd -f --system -g ${BUILDER_GROUP} elastic \
14+
&& (id -u ${BUILDER_USER} || useradd --system --shell /bin/bash -u ${BUILDER_USER} -g ${BUILDER_GROUP} -m elastic) \
15+
&& mkdir -p /usr/src/app \
16+
&& chown -R ${BUILDER_USER}:${BUILDER_GROUP} /usr/src/ \
17+
&& mkdir -p /.npm \
18+
&& chown -R ${BUILDER_USER}:${BUILDER_GROUP} /.npm \
19+
&& mkdir -p /.cache \
20+
&& chown -R ${BUILDER_USER}:${BUILDER_GROUP} /.cache
1021

1122
WORKDIR /usr/src/app
1223

24+
# run remainder of commands as non-root user
25+
USER ${BUILDER_USER}:${BUILDER_GROUP}
26+
27+
# install dependencies
1328
COPY package.json .
14-
RUN npm install
29+
RUN npm install --production=false
1530

31+
# copy project files
1632
COPY . .

.buildkite/run-client.sh

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,15 @@ script_path=$(dirname "$(realpath -s "$0")")
66
set -euo pipefail
77
repo=$(pwd)
88

9-
export NODE_VERSION=${NODE_VERSION:-16}
9+
export NODE_VERSION=${NODE_VERSION:-18}
1010

1111
echo "--- :docker: Building Docker image"
1212
docker build \
1313
--file "$script_path/Dockerfile" \
1414
--tag elastic/elasticsearch-serverless-js \
1515
--build-arg NODE_VERSION="$NODE_VERSION" \
16+
--build-arg BUILDER_USER="$(id -u)" \
17+
--build-arg BUILDER_GROUP="$(id -g)" \
1618
.
1719

1820
echo "--- :javascript: Running tests"
@@ -22,6 +24,7 @@ export GITHUB_TOKEN
2224

2325
mkdir -p "$repo/junit-output"
2426
docker run \
27+
-u "$(id -u):$(id -g)" \
2528
-e "ELASTICSEARCH_URL" \
2629
-e "ES_API_SECRET_KEY" \
2730
-e "GITHUB_TOKEN" \

.ci/make.sh

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ product="elastic/elasticsearch-serverless-js"
3737
output_folder=".ci/output"
3838
codegen_folder=".ci/output"
3939
OUTPUT_DIR="$repo/${output_folder}"
40-
NODE_VERSION=20
40+
NODE_VERSION=18
4141
WORKFLOW=${WORKFLOW-staging}
4242
mkdir -p "$OUTPUT_DIR"
4343

@@ -134,6 +134,8 @@ docker build \
134134
--file .buildkite/Dockerfile \
135135
--tag "$product" \
136136
--build-arg NODE_VERSION="$NODE_VERSION" \
137+
--build-arg BUILDER_USER="$(id -u)" \
138+
--build-arg BUILDER_GROUP="$(id -g)" \
137139
.
138140

139141
# ------------------------------------------------------- #
@@ -143,8 +145,10 @@ docker build \
143145
echo -e "\033[34;1mINFO: running $product container\033[0m"
144146

145147
# check CI env vars to enable support for both CI or running locally
146-
if [[ -z "${BUILDKITE+x}" ]] || [[ -z "${CI+x}" ]]; then
148+
if [[ -z "${BUILDKITE+x}" ]] && [[ -z "${CI+x}" ]] && [[ -z "${GITHUB_ACTIONS+x}" ]]; then
149+
echo -e "\033[34;1mINFO: Running in local mode"
147150
docker run \
151+
-u "$(id -u):$(id -g)" \
148152
--volume "$repo:/usr/src/app" \
149153
--volume "$(realpath $repo/../elastic-client-generator-js):/usr/src/elastic-client-generator-js" \
150154
--volume /usr/src/app/node_modules \
@@ -155,7 +159,9 @@ if [[ -z "${BUILDKITE+x}" ]] || [[ -z "${CI+x}" ]]; then
155159
/bin/bash -c "mkdir -p /usr/src/elastic-client-generator-js/output && \
156160
node .ci/make.mjs --task $TASK ${TASK_ARGS[*]}"
157161
else
162+
echo -e "\033[34;1mINFO: Running in CI mode"
158163
docker run \
164+
-u "$(id -u):$(id -g)" \
159165
--volume "$repo:/usr/src/app" \
160166
--volume /usr/src/app/node_modules \
161167
--env "WORKFLOW=$WORKFLOW" \

0 commit comments

Comments
 (0)