byteayan opened a new pull request, #3381:
URL: https://github.com/apache/hugegraph/pull/3381
## Purpose of the PR
- close #3211
The `hugegraph/pd`, `hugegraph/store`, `hugegraph/server` and
`hugegraph/hugegraph` images run Java as root. A namespace under the
`restricted` Pod Security Standard rejects them, the Helm chart cannot default
to non-root, and scanners flag every workload.
**Upgrade required:** existing Docker volumes written by the old root images
need a one-time `chown`, and existing Helm releases upgraded with
`--reuse-values` need `fsGroup` set explicitly. Both are documented below and
should go into the release notes.
## Main Changes
- Runtime stage of all four Dockerfiles (build stages unchanged and still
identical):
- create `hugegraph` with fixed numeric UID/GID `10001` (`ARG
HG_UID`/`HG_GID`), and a numeric `USER`, so Kubernetes can verify
`runAsNonRoot`;
- create the app directory, its data directory (`pd_data`, `storage`,
`rocksdb-data`) and `logs` owned by that user, so new named volumes mounted
there start out writable;
- `COPY --chown`, and `--chmod=755` for the entrypoint instead of a `RUN
chmod`;
- in the Server images `USER` comes before the build-time `sed -i` / `mv`
of conf files, so the rewritten files stay user-owned.
- `.github/scripts/check-docker-images.sh`: asserts each image runs as
`10001:10001` and owns its app, data and log directories; the jar check copies
files out with the runner's own UID, because the image user cannot write the
runner's temp dir.
- Helm: `pd.podSecurityContext` and `store.podSecurityContext` default to
`fsGroup: 10001` with `fsGroupChangePolicy: OnRootMismatch`, so PVCs, including
ones written by older root images, stay writable. `runAsNonRoot` is not
defaulted, so releases pinned to older root image tags keep working.
- Docs:
- `docker/README.md`: new "Container user" section covering bind mounts,
mounted conf files, the one-time `chown` for old volumes, the Compose
anonymous-volume caveat (`down` first or `up -d --renew-anon-volumes`),
Kubernetes `fsGroup`, and `docker exec -u 0`; build-arg rows.
- `helm/hugegraph/README.md` and `docs/operations.md`: `--reuse-values`
keeps the old empty `podSecurityContext`, the default `latest` + `pullPolicy:
Always` can pull the new image on any Pod restart, explicit `--set` commands,
and `OnRootMismatch` / NFS / `hostPath` caveats.
- PD and Store README `docker run` examples get a `chown` step for the
bind-mounted data directory; the Helm local-PV example and the Server Docker
README are updated.
Follow-ups, not in this PR: `readOnlyRootFilesystem` (narrowing `VOLUME`,
moving runtime writes out of `conf/`), OpenShift arbitrary-UID support (`chgrp
0` + `g=u`), the Hubble image (separate repository), `docker/hbase/Dockerfile`.
## Verifying these changes
- [ ] Trivial rework / code cleanup without any test coverage. (No Need)
- [ ] Already covered by existing tests, such as *(please modify tests
here)*.
- [x] Need tests and can be verified as follows:
- CI: the new user and ownership assertions in `check-docker-images.sh`,
plus the existing deployment checks, which run against the PR-built images.
- Locally:
- built all four runtime stages: `Config.User` is `10001:10001`, the
app/data/log directories are owned by 10001, and a fresh named volume at each
data path comes out owned by 10001;
- a standalone Server image from the real 1.8.0 distribution started
healthy as UID 10001 with `PRELOAD=true` on a new named volume;
- a root-owned volume fails with `Permission denied` before the
documented `chown` and works after it;
- the updated `check-docker-images.sh` assertions pass on all four
images, and shellcheck is clean.
- Not run locally: `helm lint` / `helm unittest` (Helm download blocked
in the test environment); `values.yaml` parses and the schema types
`podSecurityContext` as an object.
## Does this PR potentially affect the following parts?
- [ ] Dependencies
- [x] Modify configurations: Helm `pd.podSecurityContext` /
`store.podSecurityContext` defaults
- [ ] The public API
- [x] Other affects (typed here): container user changes from root to UID
10001; existing root-owned volumes need a one-time `chown` / `fsGroup`
- [ ] Nope
## Documentation Status
- [x] `Doc - TODO`: required documentation is pending; complete it before
merging.
- [ ] `Doc - Done`: documentation is included here or linked below.
- [ ] `Doc - No Need`: no user-visible documentation is affected.
Documentation files in this PR or paired hugegraph-doc PR:
`docker/README.md`, `helm/hugegraph/README.md`,
`helm/hugegraph/docs/operations.md`, `helm/hugegraph/examples/README.md`,
`hugegraph-pd/README.md`, `hugegraph-store/README.md`,
`hugegraph-server/hugegraph-dist/docker/README.md`. A paired
`apache/hugegraph-doc` PR is still needed: the website quickstarts
(`hugegraph-pd.md`, `hugegraph-hstore.md`, `hugegraph-server.md`) use bind
mounts that now need a `chown` step and an upgrade note.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
