Docker feature request: moving user/group creation and ownership change to Dockerfile about cozy-stack HOT 5 CLOSED

Hi @jessebot

Thank you for your feedback. I will take a look at it in the next few days.

from cozy-stack.

We don't consider Security audits and SOC2 compliance are selfhosting topics.
If you have professional needs for hosting cozycloud and want support from us, feel free to reach us at [email protected] and we will be glad to offer our help in a business relationship.

from cozy-stack.

Thanks for your help here and in the other issue! 🙏

If it is helpful, this is what I ended up doing to unblock the helm chart I was writing, since I do everything kubernetes native:

• Dockerfile
• entrypoint.sh

This is the helm chart I wrote that I'm happy to donate if this project would like it:
https://github.com/small-hack/cozy-helm-chart/
docs for helm chart:
https://github.com/small-hack/cozy-helm-chart/tree/main/charts/cozy-stack

from cozy-stack.

I think we will keep this cozy-stack docker image as is. Its maln purpose is for use with docker-compose to ease selfhosting. The kubernetes use case is far beyond our simple selfhosting target.

The nginx docker image you refer to is a separate image. Nginx project ships two image flavors, one running as root and an other one unpriviledged. I think this is the way to go to address each use case.

We will not be shipping unpriviledged image in the near future, however this may change later. For the time being, the way you did it by maintaining your own unpriviledged image seems the way to go.

I will close this issue for the moment.

from cozy-stack.

The kubernetes use case is far beyond our simple selfhosting target.

Kubernetes is more and more the default use case for self-hosting these days. If you ever need help with that, please feel free to reach out.

The nginx docker image you refer to is a separate image. Nginx project ships two image flavors, one running as root and an other one unpriviledged. I think this is the way to go to address each use case.

Please consider this in the future as it will open this project as a possibility for users who require secure environments, otherwise, they cannot pass certain security audits such as SOC2 compliance.

Thanks for taking a look though and have a nice day/evening depending on where you're working from 🙏

from cozy-stack.