keep-ecdsa
keep-ecdsa copied to clipboard
Run the container as a user without privileges
Currently the client runs as root by default:
user@host:~/keep-core$ sudo docker run --entrypoint "" keepnetwork/keep-ecdsa-client:latest whoami
root
Per https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user it's better to run as a non-root user when possible. This copies the approach from https://github.com/prometheus/prometheus/pull/2859, which defaults to using nobody and allows overrides using the --user flag (for more discussion see https://github.com/prometheus/prometheus/issues/3441).
After the change:
user@host:~/keep-core$ sudo docker run --entrypoint "" keep-ecdsa-nobody:latest whoami
nobody
Tested by building the image from source and running my testnet node with it and the --user $UID:$GID flag (node was originally setup using these instructions).
NOTE: This is a breaking change and after landing users will need to ensure the mounted persistent directory has the correct ownership and/or they set --user correctly.
Same thing as https://github.com/keep-network/keep-core/pull/1826.