shcizo/package-updater
1
0
Fork 0
Code Issues 8 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(master): run the master as a non-root user (#25) #27

Merged
shcizo merged 2 commits from chore/master-non-root-25 into main 2026-10-13 07:33:47 +00:00
Conversation 0 Commits 2 Files Changed 5
+84 -16
shcizo commented 2026-10-13 07:33:38 +00:00
Owner
Copy Link
Copy Source

Summary

  • The example master stack runs the master as nobody (user: "65534:65534"); it has no Docker socket and needs no root. The Dockerfile is unchanged, because the agent uses the same image and needs root for the socket.
  • The master logs config_json_readable on registry_credentials, and a registry_credentials_unreadable warning when config.json exists but cannot be opened.
  • Docs: keep the mounted registry credentials private (chown -R 65534:65534, 0700/0600), never world-readable.

Closes #25

Test plan

  • go vet ./..., go test ./... (new cmd/master/main_test.go), build
  • Image starts updater-master as 65534:65534 up to config validation
  • On the server: stack deploys, listening logged, id in the container shows uid 65534
  • With DOCKER_CONFIG mounted and chowned: config_json_readable: true, polling of a private image works
## Summary - The example master stack runs the master as nobody (`user: "65534:65534"`); it has no Docker socket and needs no root. The Dockerfile is unchanged, because the agent uses the same image and needs root for the socket. - The master logs `config_json_readable` on `registry_credentials`, and a `registry_credentials_unreadable` warning when `config.json` exists but cannot be opened. - Docs: keep the mounted registry credentials private (`chown -R 65534:65534`, `0700`/`0600`), never world-readable. Closes #25 ## Test plan - [x] `go vet ./...`, `go test ./...` (new `cmd/master/main_test.go`), build - [x] Image starts `updater-master` as 65534:65534 up to config validation - [ ] On the server: stack deploys, `listening` logged, `id` in the container shows uid 65534 - [ ] With `DOCKER_CONFIG` mounted and chowned: `config_json_readable: true`, polling of a private image works
shcizo added 2 commits 2026-10-13 07:33:38 +00:00
chore(master): run the master as nobody in the example stack (#25) a838777570
docs: keep the master's registry credentials private when running as nobody (#25) 9b9b3f9480
shcizo merged commit 307e46e4c7 into main 2026-10-13 07:33:47 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
later
Deliberately deferred; not planned yet
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
shcizo (Samuel Enocsson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shcizo/package-updater#27