Suggestion to Run Docker Extractor Images as Non-Root User

Hi @MatiasRamsland !

Thank you for suggesting this product idea. We will follow the traction this idea gets in the community. You can expect updates on this post if we decide to include this in our future roadmap, or if we require more information.

I just want to agree with @MatiasRamsland that running Docker containers as root is indeed a very bad practice. Running containers as root can introduce significant security vulnerabilities that malicious individuals could exploit. When a container runs as root, it has elevated privileges that could be used to gain unauthorized access to the host system, potentially leading to data breaches, system compromise, and other security incidents. Therefore, it is crucial to run Docker containers with the least privileges necessary to minimize these risks.

Matias, if possible, could you share your current solution with the Cognite community? This could serve as a useful interim measure until the CDF team releases their solution.

@Andre Alves 
This configuration works in our case at least. Remember to modify the installation of your required odbc driver. One more thing to note is that you might need to setup volumes on your deployment for the respective state store and logs depending on how you have set-up your config. 

# Base image
FROM cognite/db-extractor-base:3.4.4

# Install required system packages. Modify this to install your required odbc driver. 
RUN apt-get install -y odbc-postgresql

# Create a non-root user and their home directory
RUN useradd -u 8877 nonrootuser-db-extractor \
&& mkdir -p /home/nonrootuser-db-extractor \
&& chown nonrootuser-db-extractor:nonrootuser-db-extractor /home/nonrootuser-db-extractor

# Switch to the non-root user
USER nonrootuser-db-extractor

ENV PATH="/home/nonrootuser-db-extractor/.local/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
WORKDIR /home/nonrootuser-db-extractor

RUN mkdir -p config state log
RUN chmod 755 config state log

#Copying the config file
COPY config.yaml /home/nonrootuser-db-extractor/config/config_remote.yaml

#Installing the db-extractor on the non-root user
RUN set -ex && pip install --upgrade pip && pip install poetry pipx

WORKDIR /db-extractor
RUN pipx install .
RUN chmod +x /home/nonrootuser-db-extractor/.local/share/pipx/venvs/db-extractor

WORKDIR /db-extractor/db-extractor

CMD ["/home/nonrootuser-db-extractor/config/config_remote.yaml"]

# Base image
FROM cognite/db-extractor-base:3.4.4

# Install required system packages. Modify this to install your required odbc driver. 
RUN apt-get install -y odbc-postgresql

# Create a non-root user and their home directory
RUN useradd -u 8877 nonrootuser-db-extractor \
&& mkdir -p /home/nonrootuser-db-extractor \
&& chown nonrootuser-db-extractor:nonrootuser-db-extractor /home/nonrootuser-db-extractor

# Switch to the non-root user
USER nonrootuser-db-extractor

ENV PATH="/home/nonrootuser-db-extractor/.local/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
WORKDIR /home/nonrootuser-db-extractor

RUN mkdir -p config state log
RUN chmod 755 config state log

#Copying the config file
COPY config.yaml /home/nonrootuser-db-extractor/config/config_remote.yaml

#Installing the db-extractor on the non-root user
RUN set -ex && pip install --upgrade pip && pip install poetry pipx

WORKDIR /db-extractor
RUN pipx install .
RUN chmod +x /home/nonrootuser-db-extractor/.local/share/pipx/venvs/db-extractor

WORKDIR /db-extractor/db-extractor

CMD ["/home/nonrootuser-db-extractor/config/config_remote.yaml"]

Thank you very much!

We’re in the process of enhancing some of the extractors to support running as rootless containers. Timeline for release is being disucssed.