diff --git a/Dockerfile b/Dockerfile index d055fed1..fd1676e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,8 +27,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"] diff --git a/Dockerfile.amd64 b/Dockerfile.amd64 index 4afb8827..b00ed3cb 100644 --- a/Dockerfile.amd64 +++ b/Dockerfile.amd64 @@ -22,8 +22,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"] diff --git a/Dockerfile.arm64 b/Dockerfile.arm64 index 6e28377b..3bf0ebbf 100644 --- a/Dockerfile.arm64 +++ b/Dockerfile.arm64 @@ -22,8 +22,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"]