Skip to content

Commit 76fdda6

Browse files
Molter73Molter73
committed
Use a regular user, mapped to the current user on the host
1 parent 93b3e12 commit 76fdda6

7 files changed

Lines changed: 67 additions & 20 deletions

File tree

‎collector/Containerfile‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
FROM quay.io/stackrox-io/collector-builder:master
22

3+
ARG DEFAULT_GROUP
4+
ARG DEFAULT_USER
5+
36
RUN dnf install -y epel-release && \
47
dnf install -y \
58
ccache \
@@ -8,11 +11,12 @@ RUN dnf install -y epel-release && \
811
fzf \
912
inotify-tools \
1013
podman-docker \
14+
sudo \
1115
zsh && \
1216
dnf clean all && \
13-
# Install my dev environment
14-
# Clone my configuration
15-
git clone https://github.com/molter73/dotfiles "${HOME}/.config" && \
17+
groupadd -g $DEFAULT_GROUP molter && \
18+
useradd -m -l -u $DEFAULT_USER -g molter molter && \
19+
echo 'molter ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers && \
1620
# Install NeoVim
1721
curl -LO https://github.com/neovim/neovim/releases/latest/download/nvim-linux-x86_64.tar.gz && \
1822
tar -C /opt -xzf nvim-linux-x86_64.tar.gz && \
@@ -21,15 +25,22 @@ RUN dnf install -y epel-release && \
2125
curl -LO https://github.com/tree-sitter/tree-sitter/releases/latest/download/tree-sitter-linux-x64.gz && \
2226
gunzip -c tree-sitter-linux-x64.gz > /usr/local/bin/tree-sitter && \
2327
chmod +x /usr/local/bin/tree-sitter && \
24-
rm -f tree-sitter-linux-x64.gz && \
28+
rm -f tree-sitter-linux-x64.gz
29+
30+
USER molter
31+
WORKDIR /home/molter
32+
33+
# Install my dev environment
34+
RUN git clone https://github.com/molter73/dotfiles "${HOME}/.config" && \
2535
# Install starship.rs
2636
curl -sS https://starship.rs/install.sh | sh -s -- --yes && \
2737
# Install my configuration
38+
rm -f "${HOME}/.zshrc" && \
2839
"${HOME}/.config/zsh/install.sh" && \
2940
"${HOME}/.config/scripts/install.sh" && \
3041
/opt/nvim-linux-x86_64/bin/nvim --headless "+Lazy! restore" +qa
3142

32-
COPY clangd.yaml /root/.config/clangd/config.yaml
43+
COPY clangd.yaml /home/molter/.config/clangd/config.yaml
3344

3445
# scan-view default port
3546
EXPOSE 8181

‎collector/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ BUILDER_IMAGE=quay.io/mmoltras/devcontainers:collector
44
build:
55
docker build \
66
--tag $(BUILDER_IMAGE) \
7+
--build-arg DEFAULT_GROUP=$(shell id -g) \
8+
--build-arg DEFAULT_USER=$(shell id -u) \
79
-f Containerfile \
810
$(CURDIR)
911

‎falco-libs/Containerfile‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
FROM fedora:41
22

3+
ARG DEFAULT_GROUP
4+
ARG DEFAULT_USER
5+
36
RUN dnf install -y \
47
autoconf \
58
automake \
@@ -29,6 +32,7 @@ RUN dnf install -y \
2932
podman-docker \
3033
procps \
3134
python3-pip \
35+
sudo \
3236
wget \
3337
which \
3438
zsh \
@@ -53,19 +57,9 @@ RUN dnf install -y \
5357
xz \
5458
zlib-devel && \
5559
dnf clean all && \
56-
# Set some symlinks to allow building of drivers.
57-
kernel_version=$(uname -r) && \
58-
ln -s "/host/lib/modules/$kernel_version" "/lib/modules/$kernel_version" && \
59-
ln -s "/host/usr/src/kernels/$kernel_version" "/usr/src/kernels/$kernel_version" && \
60-
# Install emscripten
61-
git clone https://github.com/emscripten-core/emsdk.git && \
62-
cd emsdk && ./emsdk install latest && \
63-
./emsdk activate latest && \
64-
echo 'export EMSDK_QUIET=1' >> /root/.bashrc && \
65-
echo 'source /emsdk/emsdk_env.sh' >> /root/.bashrc && \
66-
# Install my dev environment
67-
# Clone my configuration
68-
git clone https://github.com/molter73/dotfiles "${HOME}/.config" && \
60+
groupadd -g $DEFAULT_GROUP molter && \
61+
useradd -m -l -u $DEFAULT_USER -g molter molter && \
62+
echo 'molter ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers && \
6963
# Install NeoVim
7064
curl -LO https://github.com/neovim/neovim/releases/latest/download/nvim-linux-x86_64.tar.gz && \
7165
tar -C /opt -xzf nvim-linux-x86_64.tar.gz && \
@@ -75,14 +69,32 @@ RUN dnf install -y \
7569
gunzip -c tree-sitter-linux-x64.gz > /usr/local/bin/tree-sitter && \
7670
chmod +x /usr/local/bin/tree-sitter && \
7771
rm -f tree-sitter-linux-x64.gz && \
72+
# Set some symlinks to allow building of drivers.
73+
kernel_version=$(uname -r) && \
74+
ln -s "/host/lib/modules/$kernel_version" "/lib/modules/$kernel_version" && \
75+
ln -s "/host/usr/src/kernels/$kernel_version" "/usr/src/kernels/$kernel_version"
76+
77+
USER molter
78+
WORKDIR /home/molter
79+
80+
# Install emscripten
81+
RUN git clone https://github.com/emscripten-core/emsdk.git && \
82+
cd emsdk && ./emsdk install latest && \
83+
./emsdk activate latest && \
84+
echo 'export EMSDK_QUIET=1' >> /home/molter/.bashrc && \
85+
echo 'source /emsdk/emsdk_env.sh' >> /home/molter/.bashrc && \
86+
# Install my dev environment
87+
# Clone my configuration
88+
git clone https://github.com/molter73/dotfiles "${HOME}/.config" && \
7889
# Install starship.rs
7990
curl -sS https://starship.rs/install.sh | sh -s -- --yes && \
8091
# Install my configuration
92+
rm -f "${HOME}/.zshrc" && \
8193
"${HOME}/.config/zsh/install.sh" && \
8294
"${HOME}/.config/scripts/install.sh" && \
8395
/opt/nvim-linux-x86_64/bin/nvim --headless "+Lazy! restore" +qa
8496

85-
COPY clangd.yaml /root/.config/clangd/config.yaml
97+
COPY clangd.yaml /home/molter/.config/clangd/config.yaml
8698
COPY compile-falco.sh /usr/local/bin/
8799
COPY compile-libs.sh /usr/local/bin/
88100

‎falco-libs/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ clean:
1010
build: clang-config
1111
docker build \
1212
--tag quay.io/mmoltras/devcontainers:falco-libs \
13+
--build-arg DEFAULT_GROUP=$(shell id -g) \
14+
--build-arg DEFAULT_USER=$(shell id -u) \
1315
-f Containerfile \
1416
$(CURDIR)
1517

‎lua/collector.lua‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ M.setup = function(opts)
1616
volumeMounts = opts.volumes or {},
1717
securityContext = {
1818
privileged = true,
19+
runAsUser = opts.user,
20+
runAsGroup = opts.group,
1921
},
2022
ports = {
2123
{ containerPort = 8181, hostIP = '0.0.0.0', hostPort = 8181 },

‎lua/falco.lua‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ M.setup = function(opts)
1818
volumeMounts = opts.volumes or {},
1919
securityContext = {
2020
privileged = true,
21+
runAsUser = opts.user,
22+
runAsGroup = opts.group,
2123
},
2224
stdin = true,
2325
tty = true,

‎lua/init.lua‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,18 @@ local falco_repo = os.getenv('GOPATH') .. '/src/github.com/falcosecurity/falco'
66
local collector = require('collector')
77
local falco = require('falco')
88

9+
local read_id = function(arg)
10+
local cmd = 'id ' .. arg
11+
local p = io.popen(cmd, 'r')
12+
assert(p ~= nil, 'failed to run "' .. cmd .. '"')
13+
local out = p:read('*n')
14+
p:close()
15+
return out
16+
end
17+
18+
local user = read_id('-u')
19+
local group = read_id('-g')
20+
921
local collector_claim = collector.volume_claim()
1022
local falco_claim = falco.volume_claim()
1123
local volumes = {
@@ -35,6 +47,8 @@ local collector_opts = {
3547
{ mountPath = '/root/.cache/ccache', name = 'collector-ccache', },
3648
{ mountPath = collector_repo, name = 'collector-repo', },
3749
},
50+
user = user,
51+
group = group,
3852
}
3953

4054
local falco_opts = {
@@ -52,7 +66,9 @@ local falco_opts = {
5266
{ mountPath = falco_libs_repo, name = 'falco-libs-repo', },
5367
{ mountPath = falco_testing_repo, name = 'falco-testing-repo', },
5468
{ mountPath = falco_repo, name = 'falco-repo', },
55-
}
69+
},
70+
user = user,
71+
group = group,
5672
}
5773

5874
local metadata = {

0 commit comments

Comments
 (0)