You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Would be nice to have an option to use different user and group applied during COPY step. Same effect could be achieved if explicit chown command added, but it will create a new layer.
Why it could be useful. To apply hardening - to make copied files write protected by the user, which will run application (and so that it would not possible to change it by using chmod with the same user).
Currently we apply this via rewriting commands using map/flatMap, which is not really handy.
Proposal - add 2 more settings chownUser and chownGroup both Option[String], and if they are set to Some value, then it will be used and in case of missing value it will fall back to daemonUser and daemonGroup respectively.
We need this applied for multistage docker, but I guess it is better to add the same logic to ChownCopy as well.
I will sketch a PR for this.
The text was updated successfully, but these errors were encountered:
Would be nice to have an option to use different user and group applied during
COPY
step. Same effect could be achieved if explicit chown command added, but it will create a new layer.Why it could be useful. To apply hardening - to make copied files write protected by the user, which will run application (and so that it would not possible to change it by using
chmod
with the same user).Currently we apply this via rewriting commands using map/flatMap, which is not really handy.
Proposal - add 2 more settings
chownUser
andchownGroup
bothOption[String]
, and if they are set toSome
value, then it will be used and in case of missing value it will fall back todaemonUser
anddaemonGroup
respectively.We need this applied for multistage docker, but I guess it is better to add the same logic to
ChownCopy
as well.I will sketch a PR for this.
The text was updated successfully, but these errors were encountered: