sbp commented on issue #1360: URL: https://github.com/apache/tooling-trusted-releases/issues/1360#issuecomment-4970100700
The idea was to put `su-exec atr:atr "$@"` in an `ENTRYPOINT` script, but that means having to `chown` the whole tree every time, which adds a huge extra expense to start up. Then I thought to inspect the UID/GID of the mounted state directory, but on some platforms it gets reported as root even when it's not. We're already fixing the present issue in Puppet, so this is mostly to ensure security outside of our server deployments. Perhaps the best solution is to mimic what Puppet does in other environments too, passing the equivalent of `--user="$(id -u atr):$(id -g atr)"` to Docker. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
