Re: [Discuss] Make docker image default group rootless

2023-08-29 Thread Michael Marshall
> Do we need `Support Arbitrary User IDs` in pulsar docker image to allow > root group r/w `/pulsar` ? The list of directories that the pulsar process needs to write to is listed here [0]. In order for the image to work on OpenShift out of the box, we need to follow the referenced documentation.

Re: [Discuss] Make docker image default group rootless

2023-08-29 Thread asn
Hi Michael, Do we need `Support Arbitrary User IDs` in pulsar docker image to allow root group r/w `/pulsar` ? It seems that some other opensource projects use specific uid and gid, e.g. https://github.com/docker-library/mysql/blob/master/8.0/Dockerfile.debian#L84 https://github.com/docker-libra

Re: [Discuss] Make docker image default group rootless

2023-08-29 Thread Michael Marshall
Hi yaasln, What are the security concerns related to the user being a member of the root group? I used the root group when making the docker image run as a non root user because that follows the OpenShift guidelines [0]. Thanks, Michael [0] https://docs.openshift.com/container-platform/3.11/cre

[Discuss] Make docker image default group rootless

2023-08-29 Thread asn
Hi dev, Currently, pulsar image uses root group default. To make the image more safe, we can add a group `pulsar`, and then add the default user `pulsar` into this group. The change is located at https://github.com/apache/pulsar/pull/21084 Thanks! yaalsn