fix: specify nonroot uid for manager

See kubernetes-sigs/kubebuilder#1635 for more info Signed-off-by: He Weiwei <[email protected]>
heww · Jan 27, 2021 · f3ffc12 · f3ffc12
1 parent 2be3d76
commit f3ffc12
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -3,6 +3,6 @@
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /
 COPY manager .
-USER nonroot:nonroot
+USER 65532:65532
 
 ENTRYPOINT ["/manager"]
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -13,13 +13,17 @@ spec:
       labels:
         control-plane: harbor-operator
     spec:
+      securityContext:
+        runAsUser: 65532
       containers:
       - command:
         - /manager
         args:
         - --enable-leader-election
         image: goharbor/harbor-operator:dev
         name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 500m