Problem
Currently, the MAIA workspace Docker images run containers with root privileges, allowing users and processes within containers to execute root commands. This poses a security risk, as malicious or accidental actions could compromise container isolation and potentially escalate to the host system.
Objective
Refactor all workspace Docker images to ensure they run as unprivileged containers, minimizing privileges so that root commands cannot be executed inside the container. This will enhance security and align with best practices.
Acceptance Criteria
- All workspace Docker images must be updated to run as a non-root user by default.
- Remove or update Dockerfile instructions that set the user to root.
- Ensure any necessary permissions or directories within the images are pre-owned by the expected non-root user.
- Update documentation with any changes needed for deployment or usage.
- Test all updated workspace images to ensure functionality is preserved without requiring root.
Additional Context
- Consider using Docker's
USER directive or rootless container approaches.
- Review all scripts and entry points for root-specific commands.
- Reference: Docker rootless mode documentation
Problem
Currently, the MAIA workspace Docker images run containers with root privileges, allowing users and processes within containers to execute root commands. This poses a security risk, as malicious or accidental actions could compromise container isolation and potentially escalate to the host system.
Objective
Refactor all workspace Docker images to ensure they run as unprivileged containers, minimizing privileges so that root commands cannot be executed inside the container. This will enhance security and align with best practices.
Acceptance Criteria
Additional Context
USERdirective or rootless container approaches.