opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-20 09:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Set runAsNonRoot=true in gen kube

Browse Source 
If the image being used has a user set that is a positive
integer greater than 0, then set the securityContext.runAsNonRoot
to true for the container in the generated kube yaml.

Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
This commit is contained in:
Urvashi Mohnani
2023-01-25 17:14:22 +05:30
parent c35e74f4cc
commit 958c94094e
2 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libpod/kube.go
View File

@ -686,6 +686,13 @@ func containerToV1Container(ctx context.Context, c *Container) (v1.Container, []
if imgData.User == c.User() && hasSecData {
kubeSec.RunAsGroup, kubeSec.RunAsUser = nil, nil
}
// If the image has user set as a positive integer value, then set runAsNonRoot to true
// in the kube yaml
imgUserID, err := strconv.Atoi(imgData.User)
if err == nil && imgUserID > 0 {
trueBool := true
kubeSec.RunAsNonRoot = &trueBool
}
envVariables, err := libpodEnvVarsToKubeEnvVars(c.config.Spec.Process.Env, imgData.Config.Env)
if err != nil {