Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set runAsUser for Container #657

Merged

Conversation

johnsonshih
Copy link
Contributor

@johnsonshih johnsonshih commented Sep 11, 2023

What this PR does / why we need it:
Follow the instructions from "Discovering and Using USB Cameras" (https://docs.akri.sh/demos/usb-camera-demo) using microk8s and the akri-video-streaming-app container fails to start. The error is caused by the container is running as root and the setting in deployment specifies "runAsNonRoot=true", see the output below:
Events:
Type Reason Age From Message


Normal Scheduled 34s default-scheduler Successfully assigned default/akri-video-streaming-app-76c7b6849f-922wn to k8stest-4
Normal Pulled 32s kubelet Successfully pulled image "ghcr.io/project-akri/akri/video-streaming-app:latest-dev" in 948.654388ms
Normal Pulled 31s kubelet Successfully pulled image "ghcr.io/project-akri/akri/video-streaming-app:latest-dev" in 1.096890898s
Normal Pulled 17s kubelet Successfully pulled image "ghcr.io/project-akri/akri/video-streaming-app:latest-dev" in 1.173162548s
Normal Pulling 5s (x4 over 33s) kubelet Pulling image "ghcr.io/project-akri/akri/video-streaming-app:latest-dev"
Normal Pulled 4s kubelet Successfully pulled image "ghcr.io/project-akri/akri/video-streaming-app:latest-dev" in 953.775431ms
Warning Failed 4s (x4 over 32s) kubelet Error: container has runAsNonRoot and image will run as root (pod: "akri-video-streaming-app-76c7b6849f-922wn_default(821f9947-b5da-4f20-919a-62a5318ac027)", container: akri-video-streaming-app)

Add runAsUser: 1000 to run the container using uid 1000 (which is non-root)

Special notes for your reviewer:

If applicable:

  • this PR has an associated PR with documentation in akri-docs
  • this PR contains unit tests
  • added code adheres to standard Rust formatting (cargo fmt)
  • code builds properly (cargo build)
  • code is free of common mistakes (cargo clippy)
  • all Akri tests succeed (cargo test)
  • inline documentation builds (cargo doc)
  • all commits pass the DCO bot check by being signed off -- see the failing DCO check for instructions on how to retroactively sign commits

Signed-off-by: Johnson Shih <[email protected]>
@diconico07
Copy link
Contributor

I think it would be better to change these containers to effectively run as non-root rather than allowing them to do so, I don't see any reason for this one to run as root.

@johnsonshih johnsonshih changed the title Set runAsNonRoot to false Set runAsUser for Container Sep 12, 2023
@johnsonshih
Copy link
Contributor Author

I think it would be better to change these containers to effectively run as non-root rather than allowing them to do so, I don't see any reason for this one to run as root.

Set runAsUser to run the container as non-root.

@johnsonshih johnsonshih merged commit 0cb7678 into project-akri:main Sep 12, 2023
6 checks passed
@johnsonshih johnsonshih deleted the user/jshih/video-stream-app branch September 12, 2023 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants