From 384c953bb280bb63625b1e57be57e69f64e0ca2f Mon Sep 17 00:00:00 2001 From: Ryan Northey Date: Tue, 26 May 2020 17:53:24 +0100 Subject: [PATCH 1/3] Update Dockerfile recipes to install su-exec Signed-off-by: Ryan Northey --- ci/Dockerfile-envoy | 23 ++++++++++++++++++++++- ci/Dockerfile-envoy-alpine | 2 ++ ci/Dockerfile-envoy-alpine-debug | 2 ++ 3 files changed, 26 insertions(+), 1 deletion(-) diff --git a/ci/Dockerfile-envoy b/ci/Dockerfile-envoy index 8e1046a9be358..377fb3684b8d9 100644 --- a/ci/Dockerfile-envoy +++ b/ci/Dockerfile-envoy @@ -1,4 +1,22 @@ -FROM ubuntu:18.04 +ARG BUILD_FROM=ubuntu:18.04 + + +# Build stage +FROM $BUILD_FROM as build + +RUN apt-get update \ + && apt-get upgrade -y \ + && apt-get install --no-install-recommends -y ca-certificates curl gcc libc-dev \ + && echo "d6c40440609a23483f12eb6295b5191e94baf08298a856bab6e15b10c3b82891 /tmp/su-exec.c" > /tmp/checksum \ + && curl -o /tmp/su-exec.c https://raw.githubusercontent.com/ncopa/su-exec/212b75144bbc06722fbd7661f651390dc47a43d1/su-exec.c \ + && sha256sum -c /tmp/checksum \ + && gcc -Wall /tmp/su-exec.c -o/usr/local/bin/su-exec \ + && chown root:root /usr/local/bin/su-exec \ + && chmod 0755 /usr/local/bin/su-exec + + +# Final stage +FROM $BUILD_FROM RUN apt-get update \ && apt-get upgrade -y \ @@ -8,6 +26,9 @@ RUN apt-get update \ && rm -rf /tmp/* /var/tmp/* \ && rm -rf /var/lib/apt/lists/* +COPY --from=build /usr/local/bin/su-exec /usr/local/bin/su-exec +RUN adduser --group --system envoy + RUN mkdir -p /etc/envoy ADD build_release_stripped/envoy /usr/local/bin/envoy diff --git a/ci/Dockerfile-envoy-alpine b/ci/Dockerfile-envoy-alpine index 6d993080d3b25..4ac4578370c2c 100644 --- a/ci/Dockerfile-envoy-alpine +++ b/ci/Dockerfile-envoy-alpine @@ -4,6 +4,8 @@ RUN mkdir -p /etc/envoy ADD build_release_stripped/envoy /usr/local/bin/envoy ADD configs/google_com_proxy.v2.yaml /etc/envoy/envoy.yaml +RUN apk add --no-cache shadow su-exec \ + && addgroup -S envoy && adduser --no-create-home -S envoy -G envoy EXPOSE 10000 diff --git a/ci/Dockerfile-envoy-alpine-debug b/ci/Dockerfile-envoy-alpine-debug index 56162717ae645..fe4957814612c 100644 --- a/ci/Dockerfile-envoy-alpine-debug +++ b/ci/Dockerfile-envoy-alpine-debug @@ -4,6 +4,8 @@ RUN mkdir -p /etc/envoy ADD build_release/envoy /usr/local/bin/envoy ADD configs/google_com_proxy.v2.yaml /etc/envoy/envoy.yaml +RUN apk add --no-cache shadow su-exec \ + && addgroup -S envoy && adduser --no-create-home -S envoy -G envoy EXPOSE 10000 From 57e272b07783afeb90b04cc127450daba5ba9cbb Mon Sep 17 00:00:00 2001 From: Ryan Northey Date: Tue, 26 May 2020 17:53:40 +0100 Subject: [PATCH 2/3] Update docker-entrypoint to use su-exec Signed-off-by: Ryan Northey --- ci/docker-entrypoint.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/ci/docker-entrypoint.sh b/ci/docker-entrypoint.sh index b731653319ad4..10b78e74c1d7d 100755 --- a/ci/docker-entrypoint.sh +++ b/ci/docker-entrypoint.sh @@ -13,4 +13,14 @@ if [ "$1" = 'envoy' ]; then fi fi -exec "$@" +if [ "$ENVOY_UID" != "0" ]; then + if [ -n "$ENVOY_UID" ]; then + usermod -u "$ENVOY_UID" envoy + fi + if [ -n "$ENVOY_GID" ]; then + groupmod -g "$ENVOY_GID" envoy + fi + su-exec envoy "${@}" +else + exec "${@}" +fi From 0d020df1bfe1e6204b80a216c3cb980c7332c8ab Mon Sep 17 00:00:00 2001 From: Ryan Northey Date: Tue, 2 Jun 2020 21:22:20 +0100 Subject: [PATCH 3/3] Add release note for #11323 Signed-off-by: Ryan Northey --- docs/root/version_history/current.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/root/version_history/current.rst b/docs/root/version_history/current.rst index 9fe4d345399ec..6a88f6d003287 100644 --- a/docs/root/version_history/current.rst +++ b/docs/root/version_history/current.rst @@ -13,6 +13,7 @@ Minor Behavior Changes *Changes that may cause incompatibilities for some users, but should not for most* * access loggers: applied existing buffer limits to access logs, as well as :ref:`stats ` for logged / dropped logs. This can be reverted temporarily by setting runtime feature `envoy.reloadable_features.disallow_unbounded_access_logs` to false. +* build: run as non-root inside Docker containers. Existing behaviour can be restored by setting the environment variable `ENVOY_UID` to `0`. `ENVOY_UID` and `ENVOY_GID` can be used to set the envoy user's `uid` and `gid` respectively. * hot restart: added the option :option:`--use-dynamic-base-id` to select an unused base ID at startup and the option :option:`--base-id-path` to write the base id to a file (for reuse with later hot restarts). * http: fixed several bugs with applying correct connection close behavior across the http connection manager, health checker, and connection pool. This behavior may be temporarily reverted by setting runtime feature `envoy.reloadable_features.fix_connection_close` to false. * http: fixed a bug where the upgrade header was not cleared on responses to non-upgrade requests.