fix: allow running as non-root #40642
Conversation
WalkthroughThe changes update Docker build and entrypoint scripts to improve package installation, image cleanup, and user identity handling. The base Dockerfile now installs additional packages, consolidates cleanup steps, and sets up NSS Wrapper for non-root user support. The entrypoint script configures NSS Wrapper when running as a non-root user and prevents embedded Postgres initialization in non-root mode. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Entrypoint Script
participant NSS Wrapper
User->>Entrypoint Script: Start container
Entrypoint Script->>Entrypoint Script: Check if running as non-root
alt Non-root user
Entrypoint Script->>NSS Wrapper: Create temp passwd/group files with current UID/GID
Entrypoint Script->>Entrypoint Script: Export LD_PRELOAD with NSS Wrapper symlink
end
Entrypoint Script->>Entrypoint Script: Log current UID
Entrypoint Script->>Entrypoint Script: If init_postgres, call fail_if_non_root to prevent embedded DB init
Entrypoint Script->>User: Continue application startup
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure 📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14976096450. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14976813608. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980450347. |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980505949. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980819023. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14981979160. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15005175710. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
deploy/docker/base.dockerfile (1)
25-25: Includegitin base image for consistency
This aligns with the root Dockerfile change.
🧹 Nitpick comments (1)
deploy/docker/fs/opt/appsmith/entrypoint.sh (1)
16-23: Initialize NSS wrapper for non-root users
The setup block correctly generates temporary passwd/group files. For consistency, consider using the$TMPvariable instead of hardcoding/tmp/appsmith.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
Dockerfile(1 hunks)deploy/docker/base.dockerfile(2 hunks)deploy/docker/fs/opt/appsmith/entrypoint.sh(1 hunks)
🔇 Additional comments (6)
deploy/docker/base.dockerfile (4)
24-24: Addlibnss-wrapperfor non-root user support
This package is necessary to enable NSS wrapper emulation at runtime.
33-42: Consolidated cleanup after package installation
Removing apt caches, docs, man pages, and temporary files effectively reduces image size.
88-91: Create symlink forlibnss_wrapper.so
Linking the architecture-specific library to a stable path simplifies LD_PRELOAD activation.
92-94: Export NSS wrapper environment variables
SettingNSS_WRAPPER_PASSWDandNSS_WRAPPER_GROUPprepares the container for optional runtime emulation.deploy/docker/fs/opt/appsmith/entrypoint.sh (1)
25-25: Retain user identity log placement
Moving thetlog "Running as: $(id)"call after the NSS wrapper setup improves clarity.Dockerfile (1)
16-17: Refactorapt-get installformatting for readability
Movingapt-get install -y gitto its own indented line aligns with best practices and has no functional impact.
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15031515817. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15031794549. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15048572151. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
/build-deploy-preview skip-tests=true |
|
Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15048924049. |
|
Deploy-Preview-URL: https://ce-40642.dp.appsmith.com |
|
|
||
| RUN mv /opt/caddy/caddy /opt/caddy/caddy_vanilla | ||
| | tar -xz -C /opt/caddy && \ | ||
| mv /opt/caddy/caddy /opt/caddy/caddy_vanilla |
There was a problem hiding this comment.
This removed an extra layer, removing ~50MB from the image.
github-actions
bot
added
Community Reported
|
This PR has not seen activitiy for a while. It will be closed in 7 days unless further activity is detected. |
Description
Allows the Appsmith container to run as a non-root user, specified at runtime through either docker-compose or Kubernetes pod security context. I didn't specify the user in the
Dockerfilebecause environments like OpenShift choose a user at runtime, so it can't be known at build time.This needs to be followed by an update to docs and changes in the Helm chart to finish it off, but that has a separate release cycle and this needs to go ahead of that.
Ideally we would run as non-root by default, but since there's data persisted on the filesystem automatically transitioning the default is impossible without a lot of pain. This moves us in that direction and enables it in the future if we go down that path.
Required to fix #38787
Automation
/ok-to-test tags=""
🔍 Cypress test results
Warning
Tests have not run on the HEAD 50ba745 yet
Thu, 15 May 2025 15:56:31 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit
New Features
Chores