Set unprivileged user to container image

[jpkrohling]

Signed-off-by: Juraci Paixão Kröhling [email protected]

Description: This change sets a custom user to the container image, under an ID that yields an unprivileged user.

Related PR: open-telemetry/opentelemetry-collector#2838

[codecov]

Codecov Report

Merging #2925 (c78c3fd) into main (791c7f9) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2925   +/-   ##
=======================================
  Coverage   91.53%   91.54%           
=======================================
  Files         463      463           
  Lines       22779    22779           
=======================================
+ Hits        20851    20853    +2     
+ Misses       1436     1435    -1     
+ Partials      492      491    -1     

Flag	Coverage Δ
integration	69.09% <ø> (ø)
unit	90.51% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
receiver/k8sclusterreceiver/watcher.go	97.64% <0.00%> (+2.35%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 791c7f9...c78c3fd. Read the comment docs.

[bogdandrutu]

We probably need the same change on the core, and in all dockers (including examples)

[jpkrohling]

I opened a PR for the core already: open-telemetry/opentelemetry-collector#2838

I did find other images for other purposes, like examples but wasn't sure those are published somewhere.

[bogdandrutu]

They are not published, but we should still not build them as root correct?

[jpkrohling]

They are not published, but we should still not build them as root correct?

The problem isn't at build time, but at runtime. We should indeed provide the best image we can, even for examples, but I'd argue that those are not that critical and may potentially confuse users.

In any case, I went through the one in this repo and did a couple of extra changes:

• expose port 4317 in addition to 55679/55680, as a first step in deprecating the old OTLP port
• add the high UID to all images, except the fpm one, which I have no idea how it works
• bumped the Go builder images to 1.16, which should cover a couple of CVEs in Go itself

Let me know if you think those changes aren't desirable.

[bogdandrutu]

@jpkrohling looks like examples failed to build:

ERROR: Unable to lock database: Permission denied
ERROR: Failed to open apk database: Permission denied
ERROR: Service 'otel-collector' failed to build : The command '/bin/sh -c apk --update add ca-certificates' returned a non-zero code: 99
make: *** [Makefile:237: build-examples] Error 1

[jpkrohling]

Dockerfile for the example fixed.