From ae197908be4c10fd0a28d337128189b9446c3766 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20=22Pisco=22=20Fernandes?= Date: Thu, 3 Jul 2025 11:31:04 +0100 Subject: [PATCH] TUN-9540: Use numeric user id for Dockerfiles ## Summary This commit changes the USER instruction in our Dockerfiles from using the string "nonroot" to its numeric ID "65532". This change is necessary because Kubernetes does not support string-based user IDs in security contexts, requiring numeric IDs instead. The nonroot user maps to 65532 in distroless images. --- Dockerfile | 7 +++++-- Dockerfile.amd64 | 7 +++++-- Dockerfile.arm64 | 7 +++++-- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index d055fed1..fd1676e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,8 +27,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"] diff --git a/Dockerfile.amd64 b/Dockerfile.amd64 index 4afb8827..b00ed3cb 100644 --- a/Dockerfile.amd64 +++ b/Dockerfile.amd64 @@ -22,8 +22,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"] diff --git a/Dockerfile.arm64 b/Dockerfile.arm64 index 6e28377b..3bf0ebbf 100644 --- a/Dockerfile.arm64 +++ b/Dockerfile.arm64 @@ -22,8 +22,11 @@ LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared # copy our compiled binary COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/ -# run as non-privileged user -USER nonroot +# run as nonroot user +# We need to use numeric user id's because Kubernetes doesn't support strings: +# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49 +# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18 +USER 65532:65532 # command / entrypoint of container ENTRYPOINT ["cloudflared", "--no-autoupdate"]