Running as root weakens container isolation

[rbtcollins]

The dd agent build runs as root rather than a dedicated user. Running as root in a container grants root access to anything mapped into the container (e.g. the docker socket and system calls).

While its arguably a low risk,, the dd agent is indirectly attackable (e.g. via log grepping parsers etc) - and so we'd prefer to be running it as a dedicated non-root user with just the minimum privileges needed.

[xvello]

Hi @rbtcollins,

We have identified this in our backlog, but this might break compatibility for several deployment special cases, which is why we decided not to go with it for agent 5.
As we are hard at work on the next major version of the agent, running unprivileged is in the roadmap for agent 6.

Regards