)]}'
{"Dockerfile":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"25fbd66f58158eafff7ff89911d6c483baa0ce7c","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  \u0026\u0026 rm -rf /output"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"### Containers should NOT run as root as a good practice"},{"line_number":45,"context_line":"RUN chmod g\u003du /etc/passwd"},{"line_number":46,"context_line":"ENV APP_ROOT\u003d/var/lib/zuul"},{"line_number":47,"context_line":"ENV HOME\u003d${APP_ROOT}"},{"line_number":48,"context_line":"ENV USER_NAME\u003dzuul"}],"source_content_type":"text/x-dockerfile","patch_set":8,"id":"3fa7e38b_c7030375","line":45,"updated":"2020-01-31 17:12:31.000000000","message":"This is a vector for privilege escalation.","commit_id":"7684e049a12aa50cfbd0470bebb48b53eb6a85b4"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"9b297852191f0472e9250efda210ae3d5c4f59f9","unresolved":false,"context_lines":[{"line_number":40,"context_line":"RUN /output/install-from-bindep \\"},{"line_number":41,"context_line":"  \u0026\u0026 pip install --cache-dir\u003d/output/wheels -r /output/zuul_base/requirements.txt \\"},{"line_number":42,"context_line":"  \u0026\u0026 rm -rf /output"},{"line_number":43,"context_line":"RUN useradd -u 1000 -m -d /var/lib/zuul zuul"},{"line_number":44,"context_line":"VOLUME /var/lib/zuul"},{"line_number":45,"context_line":"CMD [\"/usr/local/bin/zuul\"]"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-dockerfile","patch_set":10,"id":"3fa7e38b_082ccb47","line":43,"updated":"2020-01-31 19:05:22.000000000","message":"Should we add a USER line here so that the \"zuul\" target runs as this user too?","commit_id":"6efb6ef1eb0ad77af3c4ebeb63e97017998e8679"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"989e183e648cb50078edd701ab8273d8a0ef9a0c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"RUN /output/install-from-bindep \\"},{"line_number":41,"context_line":"  \u0026\u0026 pip install --cache-dir\u003d/output/wheels -r /output/zuul_base/requirements.txt \\"},{"line_number":42,"context_line":"  \u0026\u0026 rm -rf /output"},{"line_number":43,"context_line":"RUN useradd -u 1000 -m -d /var/lib/zuul zuul"},{"line_number":44,"context_line":"VOLUME /var/lib/zuul"},{"line_number":45,"context_line":"CMD [\"/usr/local/bin/zuul\"]"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-dockerfile","patch_set":10,"id":"3fa7e38b_68769f43","line":43,"in_reply_to":"3fa7e38b_082ccb47","updated":"2020-01-31 19:16:10.000000000","message":"Perhaps, iirc that wasn\u0027t working before, maybe now it\u0027s ok?","commit_id":"6efb6ef1eb0ad77af3c4ebeb63e97017998e8679"},{"author":{"_account_id":2475,"name":"Antoine Musso","email":"hashar@free.fr","username":"hashar"},"change_message_id":"5e71d6ee1cc786905e6dc66131986684f8ef34a3","unresolved":false,"context_lines":[{"line_number":40,"context_line":"RUN /output/install-from-bindep \\"},{"line_number":41,"context_line":"  \u0026\u0026 pip install --cache-dir\u003d/output/wheels -r /output/zuul_base/requirements.txt \\"},{"line_number":42,"context_line":"  \u0026\u0026 rm -rf /output"},{"line_number":43,"context_line":"RUN useradd -u 10001 -m -d /var/lib/zuul -c \"Zuul Daemon\" zuul"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"VOLUME /var/lib/zuul"},{"line_number":46,"context_line":"CMD [\"/usr/local/bin/zuul\"]"}],"source_content_type":"text/x-dockerfile","patch_set":12,"id":"3fa7e38b_17d1422f","line":43,"updated":"2020-02-01 13:28:54.000000000","message":"While at it, one might also want to instruct the entrypoint / command to be run as `zuul`?\n\n USER zuul\n\nElse the container still defaults to be running as root user:\n\n $ docker run --rm -it --entrypoint\u003did zuul\n uid\u003d0(root) gid\u003d0(root) groups\u003d0(root)\n\n\nNote that unless one has enabled user namespacing, the containerized process on the host stil has the UID 10001 which \"might\" bind to a real user.\n\nMaybe a better choice might be to use the nobody user (uid 65534) which has even less privileges :]\n\n\n0.02€","commit_id":"c56250de36d2dfae5a30f08cb4d50bd1a0c8477e"}],"doc/source/examples/docker-compose.yaml":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"72cf5f6ec8b7629f061e030afa87a9108c266e94","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  sshkey:"},{"line_number":129,"context_line":"  nodessh:"},{"line_number":130,"context_line":"  logs:"},{"line_number":131,"context_line":"  zuul:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"3fa7e38b_4cbbba0f","line":131,"updated":"2020-01-31 15:50:27.000000000","message":"I don\u0027t think we need (or want) to share this volume between the containers.","commit_id":"7684e049a12aa50cfbd0470bebb48b53eb6a85b4"}],"tools/uid_entrypoint.sh":[{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"1425b189fb711c26fc8a091e69bd232c7ffff771","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    echo \"${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:${HOME}:/sbin/nologin\" \u003e\u003e /etc/passwd"},{"line_number":20,"context_line":"  fi"},{"line_number":21,"context_line":"fi"},{"line_number":22,"context_line":"exec \"$@\""}],"source_content_type":"text/x-sh","patch_set":3,"id":"5fc1f717_78ad5f2f","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":9},"updated":"2019-04-10 12:01:35.000000000","message":"The python-base image has an entrypoint of /usr/bin/dumb-init, which provides signal handling. Replacing that with this means this should be:\n\n  exec dumb-init \"$@\"","commit_id":"c0710ee6141ce49a19ea22a81e3e987824d5694d"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"339ca3a9aba806dc6fd92acb963b03372d580e2d","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    echo \"${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:${HOME}:/sbin/nologin\" \u003e\u003e /etc/passwd"},{"line_number":20,"context_line":"  fi"},{"line_number":21,"context_line":"fi"},{"line_number":22,"context_line":"exec \"$@\""}],"source_content_type":"text/x-sh","patch_set":3,"id":"5fc1f717_6cde006b","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":9},"in_reply_to":"5fc1f717_78ad5f2f","updated":"2019-04-10 12:19:25.000000000","message":"Done","commit_id":"c0710ee6141ce49a19ea22a81e3e987824d5694d"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"7470c9588986fe01d9598d8f6c02adc89cc4bce6","unresolved":false,"context_lines":[{"line_number":14,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":15,"context_line":"# limitations under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"if ! whoami 2\u003e\u00261 /dev/null; then"},{"line_number":18,"context_line":"  if [ -w /etc/passwd ]; then"},{"line_number":19,"context_line":"    echo \"${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:${HOME}:/sbin/nologin\" \u003e\u003e /etc/passwd"},{"line_number":20,"context_line":"  fi"}],"source_content_type":"text/x-sh","patch_set":7,"id":"3fa7e38b_51983166","line":17,"updated":"2020-01-31 15:20:33.000000000","message":"I think you\u0027re missing an extra \u003e here:\n\nhttps://zuul.opendev.org/t/zuul/build/2560c9f640e0472ebbf663c81bd401ad/log/container_logs/gerritconfig.log#1","commit_id":"32d46757e047eaa9d001057ee0333826d7e8ef88"}]}