Dockerfile Security Best Practices

Re:Dockerfile Security Best Practices by kelnos on Wednesday October 14, 2020 @06:15PM (#24782322)

Regarding using

    USER somenonrootuser

... how do people deal with the need to write things out on container start? Some of my services require config files, and I need to interpolate the values of environment variables into those config files, write them out, and then start the application. (Also assume the application itself doesn't have options for dropping privileges.) I'd rather not make the filesystem locations in question writable by `somenonrootuser`.

My current strategy is to let the container entrypoint start as root, but then I have a wrapper program installed that drops privileges before it exec()s the actual service. It works, but is there a better / more accepted way of doing this?

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by Propaganda_ on Wednesday October 14, 2020 @06:29PM (#24782458)

If the services can't be modified to load their config directly from env vars, write the config to an off-root scratch volume (e.g. mounted to /tmp/) and have them load from that. The root volume should be mounted read-only either way to prevent modification of your services should something get RCE.

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by piaste on Wednesday October 14, 2020 @08:29PM (#24783420)

If you control the services, make them read from user-writable files instead of root ones. (Ideally you could skip the middleman and just read from env vars directly!)

If you don't control the services, maybe in the Dockerfile you could write a dummy config file and chmod it?

[ Parent | on HN ]

Re:Dockerfile Security Best Practices by CGamesPlay on Wednesday October 14, 2020 @08:26PM (#24783402)

[deleted] this idea doesn't work on attempting

[ Parent | on HN ]