Skip to content

Commit 78ac6bb

Browse files
avi-sanwalasanwal
avi-sanwal
authored and
asanwal
committed
FLINK-37881: Drop gosu in favour of Dockerfile USER
1 parent 6e22650 commit 78ac6bb

File tree

12 files changed

+66
-204
lines changed

12 files changed

+66
-204
lines changed

‎1.20/scala_2.12-java11-ubuntu/Dockerfile‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,6 @@ RUN set -ex; \
2424
apt-get -y install gpg libsnappy1v5 gettext-base libjemalloc-dev; \
2525
rm -rf /var/lib/apt/lists/*
2626

27-
# Grab gosu for easy step-down from root
28-
ENV GOSU_VERSION 1.11
29-
RUN set -ex; \
30-
wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
31-
wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
32-
export GNUPGHOME="$(mktemp -d)"; \
33-
for server in ha.pool.sks-keyservers.net $(shuf -e \
34-
hkp://p80.pool.sks-keyservers.net:80 \
35-
keyserver.ubuntu.com \
36-
hkp://keyserver.ubuntu.com:80 \
37-
pgp.mit.edu) ; do \
38-
gpg --batch --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
39-
done && \
40-
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
41-
gpgconf --kill all; \
42-
rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
43-
chmod +x /usr/local/bin/gosu; \
44-
gosu nobody true
45-
4627
# Configure Flink version
4728
ENV FLINK_TGZ_URL=https://dlcdn.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz \
4829
FLINK_ASC_URL=https://downloads.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz.asc \
@@ -99,6 +80,7 @@ RUN set -ex; \
9980
fi;
10081

10182
# Configure container
83+
USER flink
10284
COPY docker-entrypoint.sh /
10385
ENTRYPOINT ["/docker-entrypoint.sh"]
10486
EXPOSE 6123 8081

‎1.20/scala_2.12-java11-ubuntu/docker-entrypoint.sh‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,9 @@ COMMAND_HISTORY_SERVER="history-server"
2525
JOB_MANAGER_RPC_ADDRESS=${JOB_MANAGER_RPC_ADDRESS:-$(hostname -f)}
2626
CONF_FILE_DIR="${FLINK_HOME}/conf"
2727

28-
drop_privs_cmd() {
29-
if [ $(id -u) != 0 ]; then
30-
# Don't need to drop privs if EUID != 0
31-
return
32-
elif [ -x /sbin/su-exec ]; then
33-
# Alpine
34-
echo su-exec flink
35-
else
36-
# Others
37-
echo gosu flink
28+
check_priv_user() {
29+
if [ $(id -u) == 0 ]; then
30+
echo "WARNING: Running as root user is not recommended. Please use a non-root user to run Flink."
3831
fi
3932
}
4033

@@ -146,6 +139,8 @@ maybe_enable_jemalloc() {
146139
fi
147140
}
148141

142+
check_priv_user
143+
149144
maybe_enable_jemalloc
150145

151146
copy_plugins_if_required
@@ -163,28 +158,28 @@ elif [ "$1" = "jobmanager" ]; then
163158

164159
echo "Starting Job Manager"
165160

166-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
161+
exec "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
167162
elif [ "$1" = ${COMMAND_STANDALONE} ]; then
168163
args=("${args[@]:1}")
169164

170165
echo "Starting Job Manager"
171166

172-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
167+
exec "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
173168
elif [ "$1" = ${COMMAND_HISTORY_SERVER} ]; then
174169
args=("${args[@]:1}")
175170

176171
echo "Starting History Server"
177172

178-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
173+
exec "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
179174
elif [ "$1" = "taskmanager" ]; then
180175
args=("${args[@]:1}")
181176

182177
echo "Starting Task Manager"
183178

184-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
179+
exec "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
185180
fi
186181

187182
args=("${args[@]}")
188183

189184
# Running command in pass-through mode
190-
exec $(drop_privs_cmd) "${args[@]}"
185+
exec "${args[@]}"

‎1.20/scala_2.12-java17-ubuntu/Dockerfile‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,6 @@ RUN set -ex; \
2424
apt-get -y install gpg libsnappy1v5 gettext-base libjemalloc-dev; \
2525
rm -rf /var/lib/apt/lists/*
2626

27-
# Grab gosu for easy step-down from root
28-
ENV GOSU_VERSION 1.11
29-
RUN set -ex; \
30-
wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
31-
wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
32-
export GNUPGHOME="$(mktemp -d)"; \
33-
for server in ha.pool.sks-keyservers.net $(shuf -e \
34-
hkp://p80.pool.sks-keyservers.net:80 \
35-
keyserver.ubuntu.com \
36-
hkp://keyserver.ubuntu.com:80 \
37-
pgp.mit.edu) ; do \
38-
gpg --batch --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
39-
done && \
40-
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
41-
gpgconf --kill all; \
42-
rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
43-
chmod +x /usr/local/bin/gosu; \
44-
gosu nobody true
45-
4627
# Configure Flink version
4728
ENV FLINK_TGZ_URL=https://dlcdn.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz \
4829
FLINK_ASC_URL=https://downloads.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz.asc \
@@ -99,6 +80,7 @@ RUN set -ex; \
9980
fi;
10081

10182
# Configure container
83+
USER flink
10284
COPY docker-entrypoint.sh /
10385
ENTRYPOINT ["/docker-entrypoint.sh"]
10486
EXPOSE 6123 8081

‎1.20/scala_2.12-java17-ubuntu/docker-entrypoint.sh‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,9 @@ COMMAND_HISTORY_SERVER="history-server"
2525
JOB_MANAGER_RPC_ADDRESS=${JOB_MANAGER_RPC_ADDRESS:-$(hostname -f)}
2626
CONF_FILE_DIR="${FLINK_HOME}/conf"
2727

28-
drop_privs_cmd() {
29-
if [ $(id -u) != 0 ]; then
30-
# Don't need to drop privs if EUID != 0
31-
return
32-
elif [ -x /sbin/su-exec ]; then
33-
# Alpine
34-
echo su-exec flink
35-
else
36-
# Others
37-
echo gosu flink
28+
check_priv_user() {
29+
if [ $(id -u) == 0 ]; then
30+
echo "WARNING: Running as root user is not recommended. Please use a non-root user to run Flink."
3831
fi
3932
}
4033

@@ -146,6 +139,8 @@ maybe_enable_jemalloc() {
146139
fi
147140
}
148141

142+
check_priv_user
143+
149144
maybe_enable_jemalloc
150145

151146
copy_plugins_if_required
@@ -163,28 +158,28 @@ elif [ "$1" = "jobmanager" ]; then
163158

164159
echo "Starting Job Manager"
165160

166-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
161+
exec "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
167162
elif [ "$1" = ${COMMAND_STANDALONE} ]; then
168163
args=("${args[@]:1}")
169164

170165
echo "Starting Job Manager"
171166

172-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
167+
exec "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
173168
elif [ "$1" = ${COMMAND_HISTORY_SERVER} ]; then
174169
args=("${args[@]:1}")
175170

176171
echo "Starting History Server"
177172

178-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
173+
exec "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
179174
elif [ "$1" = "taskmanager" ]; then
180175
args=("${args[@]:1}")
181176

182177
echo "Starting Task Manager"
183178

184-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
179+
exec "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
185180
fi
186181

187182
args=("${args[@]}")
188183

189184
# Running command in pass-through mode
190-
exec $(drop_privs_cmd) "${args[@]}"
185+
exec "${args[@]}"

‎1.20/scala_2.12-java8-ubuntu/Dockerfile‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,6 @@ RUN set -ex; \
2424
apt-get -y install gpg libsnappy1v5 gettext-base libjemalloc-dev; \
2525
rm -rf /var/lib/apt/lists/*
2626

27-
# Grab gosu for easy step-down from root
28-
ENV GOSU_VERSION 1.11
29-
RUN set -ex; \
30-
wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
31-
wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
32-
export GNUPGHOME="$(mktemp -d)"; \
33-
for server in ha.pool.sks-keyservers.net $(shuf -e \
34-
hkp://p80.pool.sks-keyservers.net:80 \
35-
keyserver.ubuntu.com \
36-
hkp://keyserver.ubuntu.com:80 \
37-
pgp.mit.edu) ; do \
38-
gpg --batch --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
39-
done && \
40-
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
41-
gpgconf --kill all; \
42-
rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
43-
chmod +x /usr/local/bin/gosu; \
44-
gosu nobody true
45-
4627
# Configure Flink version
4728
ENV FLINK_TGZ_URL=https://dlcdn.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz \
4829
FLINK_ASC_URL=https://downloads.apache.org/flink/flink-1.20.1/flink-1.20.1-bin-scala_2.12.tgz.asc \
@@ -99,6 +80,7 @@ RUN set -ex; \
9980
fi;
10081

10182
# Configure container
83+
USER flink
10284
COPY docker-entrypoint.sh /
10385
ENTRYPOINT ["/docker-entrypoint.sh"]
10486
EXPOSE 6123 8081

‎1.20/scala_2.12-java8-ubuntu/docker-entrypoint.sh‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,9 @@ COMMAND_HISTORY_SERVER="history-server"
2525
JOB_MANAGER_RPC_ADDRESS=${JOB_MANAGER_RPC_ADDRESS:-$(hostname -f)}
2626
CONF_FILE_DIR="${FLINK_HOME}/conf"
2727

28-
drop_privs_cmd() {
29-
if [ $(id -u) != 0 ]; then
30-
# Don't need to drop privs if EUID != 0
31-
return
32-
elif [ -x /sbin/su-exec ]; then
33-
# Alpine
34-
echo su-exec flink
35-
else
36-
# Others
37-
echo gosu flink
28+
check_priv_user() {
29+
if [ $(id -u) == 0 ]; then
30+
echo "WARNING: Running as root user is not recommended. Please use a non-root user to run Flink."
3831
fi
3932
}
4033

@@ -146,6 +139,8 @@ maybe_enable_jemalloc() {
146139
fi
147140
}
148141

142+
check_priv_user
143+
149144
maybe_enable_jemalloc
150145

151146
copy_plugins_if_required
@@ -163,28 +158,28 @@ elif [ "$1" = "jobmanager" ]; then
163158

164159
echo "Starting Job Manager"
165160

166-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
161+
exec "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
167162
elif [ "$1" = ${COMMAND_STANDALONE} ]; then
168163
args=("${args[@]:1}")
169164

170165
echo "Starting Job Manager"
171166

172-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
167+
exec "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
173168
elif [ "$1" = ${COMMAND_HISTORY_SERVER} ]; then
174169
args=("${args[@]:1}")
175170

176171
echo "Starting History Server"
177172

178-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
173+
exec "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
179174
elif [ "$1" = "taskmanager" ]; then
180175
args=("${args[@]:1}")
181176

182177
echo "Starting Task Manager"
183178

184-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
179+
exec "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
185180
fi
186181

187182
args=("${args[@]}")
188183

189184
# Running command in pass-through mode
190-
exec $(drop_privs_cmd) "${args[@]}"
185+
exec "${args[@]}"

‎2.0/scala_2.12-java11-ubuntu/Dockerfile‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,6 @@ RUN set -ex; \
2424
apt-get -y install gpg libsnappy1v5 gettext-base libjemalloc-dev; \
2525
rm -rf /var/lib/apt/lists/*
2626

27-
# Grab gosu for easy step-down from root
28-
ENV GOSU_VERSION 1.11
29-
RUN set -ex; \
30-
wget -nv -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)"; \
31-
wget -nv -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc"; \
32-
export GNUPGHOME="$(mktemp -d)"; \
33-
for server in ha.pool.sks-keyservers.net $(shuf -e \
34-
hkp://p80.pool.sks-keyservers.net:80 \
35-
keyserver.ubuntu.com \
36-
hkp://keyserver.ubuntu.com:80 \
37-
pgp.mit.edu) ; do \
38-
gpg --batch --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
39-
done && \
40-
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
41-
gpgconf --kill all; \
42-
rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
43-
chmod +x /usr/local/bin/gosu; \
44-
gosu nobody true
45-
4627
# Configure Flink version
4728
ENV FLINK_TGZ_URL=https://dlcdn.apache.org/flink/flink-2.0.0/flink-2.0.0-bin-scala_2.12.tgz \
4829
FLINK_ASC_URL=https://downloads.apache.org/flink/flink-2.0.0/flink-2.0.0-bin-scala_2.12.tgz.asc \
@@ -90,6 +71,7 @@ RUN set -ex; \
9071
"-rmKV" "taskmanager.host=localhost";
9172

9273
# Configure container
74+
USER flink
9375
COPY docker-entrypoint.sh /
9476
ENTRYPOINT ["/docker-entrypoint.sh"]
9577
EXPOSE 6123 8081

‎2.0/scala_2.12-java11-ubuntu/docker-entrypoint.sh‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,9 @@ COMMAND_HISTORY_SERVER="history-server"
2525
JOB_MANAGER_RPC_ADDRESS=${JOB_MANAGER_RPC_ADDRESS:-$(hostname -f)}
2626
CONF_FILE_DIR="${FLINK_HOME}/conf"
2727

28-
drop_privs_cmd() {
29-
if [ $(id -u) != 0 ]; then
30-
# Don't need to drop privs if EUID != 0
31-
return
32-
elif [ -x /sbin/su-exec ]; then
33-
# Alpine
34-
echo su-exec flink
35-
else
36-
# Others
37-
echo gosu flink
28+
check_priv_user() {
29+
if [ $(id -u) == 0 ]; then
30+
echo "WARNING: Running as root user is not recommended. Please use a non-root user to run Flink."
3831
fi
3932
}
4033

@@ -146,6 +139,8 @@ maybe_enable_jemalloc() {
146139
fi
147140
}
148141

142+
check_priv_user
143+
149144
maybe_enable_jemalloc
150145

151146
copy_plugins_if_required
@@ -163,28 +158,28 @@ elif [ "$1" = "jobmanager" ]; then
163158

164159
echo "Starting Job Manager"
165160

166-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
161+
exec "$FLINK_HOME/bin/jobmanager.sh" start-foreground "${args[@]}"
167162
elif [ "$1" = ${COMMAND_STANDALONE} ]; then
168163
args=("${args[@]:1}")
169164

170165
echo "Starting Job Manager"
171166

172-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
167+
exec "$FLINK_HOME/bin/standalone-job.sh" start-foreground "${args[@]}"
173168
elif [ "$1" = ${COMMAND_HISTORY_SERVER} ]; then
174169
args=("${args[@]:1}")
175170

176171
echo "Starting History Server"
177172

178-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
173+
exec "$FLINK_HOME/bin/historyserver.sh" start-foreground "${args[@]}"
179174
elif [ "$1" = "taskmanager" ]; then
180175
args=("${args[@]:1}")
181176

182177
echo "Starting Task Manager"
183178

184-
exec $(drop_privs_cmd) "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
179+
exec "$FLINK_HOME/bin/taskmanager.sh" start-foreground "${args[@]}"
185180
fi
186181

187182
args=("${args[@]}")
188183

189184
# Running command in pass-through mode
190-
exec $(drop_privs_cmd) "${args[@]}"
185+
exec "${args[@]}"

0 commit comments

Comments
 (0)