create non-root users for containers by rcmadhankumar · Pull Request #3020 · SUSE/BCI-dockerfile-generator

rcmadhankumar · 2025-10-07T08:34:45Z

Adding non root users to bci containers.

github-actions · 2025-10-07T08:35:32Z

Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-3020
Changes pushed to branch 16.0-3020 as commit 9ecde44279de56a0a71723be5ec3dd5a17dec665
Build failed ❌

Build Results

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for x86_64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for aarch64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for s390x: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log

Repository containerkiwi in home:pushman:BCI:Staging:16.0:16.0-3020 for ppc64le: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for x86_64: current state: published
Build results:

package name	status	build log
git-image	❌ failed	live log
helm-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for aarch64: current state: published
Build results:

package name	status	build log
git-image	❌ failed	live log
helm-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for s390x: current state: published
Build results:

package name	status	build log
git-image	❌ failed	live log
helm-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:16.0:16.0-3020 for ppc64le: current state: published
Build results:

package name	status	build log
git-image	❌ failed	live log
helm-image	✅ succeeded	live log

Build failed ❌

To run BCI-tests against this PR, use the following command:

OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3020/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-3020/containerfile/suse/helm:3

github-actions · 2025-10-07T08:35:36Z

Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020
Changes pushed to branch Tumbleweed-3020 as commit d45fe67769c5c3b0dce956d310e8d300f8ba0ec9
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for x86_64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-1.31-image	⛔ excluded	live log
kubectl-1.32-image	⛔ excluded	live log
kubectl-1.33-image	⛔ excluded	live log
kubectl-1.34-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for aarch64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-1.31-image	⛔ excluded	live log
kubectl-1.32-image	⛔ excluded	live log
kubectl-1.33-image	⛔ excluded	live log
kubectl-1.34-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for x86_64: current state: published
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-1.31-image	✅ succeeded	live log
kubectl-1.32-image	✅ succeeded	live log
kubectl-1.33-image	✅ succeeded	live log
kubectl-1.34-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-3020 for aarch64: current state: published
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-1.31-image	✅ succeeded	live log
kubectl-1.32-image	✅ succeeded	live log
kubectl-1.33-image	✅ succeeded	live log
kubectl-1.34-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/git:latest
registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/helm:latest
registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/kubectl:latest
registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/samba-client:latest
registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-3020/containerfile/opensuse/samba-toolbox:latest

github-actions · 2025-10-07T08:35:38Z

Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-3020
Changes pushed to branch 7-3020 as commit c7de71a732724f095041e5d72910cf0939aec0f6
Build succeeded ✅

Build Results

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for x86_64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-oldstable-image	⛔ excluded	live log
kubectl-stable-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for aarch64: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-oldstable-image	⛔ excluded	live log
kubectl-stable-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for s390x: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-oldstable-image	⛔ excluded	live log
kubectl-stable-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository images in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for ppc64le: current state: published
Build results:

package name	status	build log
git-image	⛔ excluded	live log
helm-image	⛔ excluded	live log
kubectl-oldstable-image	⛔ excluded	live log
kubectl-stable-image	⛔ excluded	live log
samba-client-image	⛔ excluded	live log
samba-toolbox-image	⛔ excluded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for x86_64: current state: publishing
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-oldstable-image	✅ succeeded	live log
kubectl-stable-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for aarch64: current state: publishing
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-oldstable-image	✅ succeeded	live log
kubectl-stable-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for s390x: current state: publishing
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-oldstable-image	✅ succeeded	live log
kubectl-stable-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Repository containerfile in home:pushman:BCI:Staging:SLE-15-SP7:7-3020 for ppc64le: current state: publishing
Build results:

package name	status	build log
git-image	✅ succeeded	live log
helm-image	✅ succeeded	live log
kubectl-oldstable-image	✅ succeeded	live log
kubectl-stable-image	✅ succeeded	live log
samba-client-image	✅ succeeded	live log
samba-toolbox-image	✅ succeeded	live log

Build succeeded ✅

To run BCI-tests against this PR, use the following command:

OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/ tox -- -n auto

The following images can be pulled from the staging project:

registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/git:latest
registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/helm:latest
registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/kubectl:latest
registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/samba-client:latest
registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-3020/containerfile/suse/samba-toolbox:latest

alexandrevicenzi · 2025-10-13T08:54:46Z

        build_stage_custom_end=generate_package_version_check(
            "git-core", git_version, ParseVersion.MINOR, use_target=True
        ),
+        user_chown=StableUser(


Do we really need to create a user for Git and such containers? All we need is to set correct file permissions so that it can run with any user.

However, if we go with a Git user, at least the container should use it, which it does not seem to use right now, so this change has not much of an effect on the image.

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

9353e61

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

472abd4

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

d343dd2

rcmadhankumar force-pushed the non-root-users-creation branch from fab916b to f6d72a8 Compare October 7, 2025 08:35

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

d759b19

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

da8c22c

bci-pushman pushed a commit that referenced this pull request Oct 7, 2025

Test build for #3020

5fbadf4

rcmadhankumar force-pushed the non-root-users-creation branch 2 times, most recently from c03e89a to d60cfe5 Compare October 13, 2025 08:45

rcmadhankumar changed the title ~~[WIP] create non-root users for containers~~ create non-root users for containers Oct 13, 2025

rcmadhankumar force-pushed the non-root-users-creation branch from d60cfe5 to 513bda9 Compare October 13, 2025 08:51

bci-pushman pushed a commit that referenced this pull request Oct 13, 2025

Test build for #3020

74c1b59

bci-pushman pushed a commit that referenced this pull request Oct 13, 2025

Test build for #3020

8437062

bci-pushman pushed a commit that referenced this pull request Oct 13, 2025

Test build for #3020

54c676c

alexandrevicenzi reviewed Oct 13, 2025

View reviewed changes

rcmadhankumar force-pushed the non-root-users-creation branch from 513bda9 to c597281 Compare October 17, 2025 04:56

rcmadhankumar added 2 commits October 17, 2025 10:27

Add user create flag to create stable user if the user deosn't exist

1a3d02a

create non-root users for cli containers

c597281

bci-pushman pushed a commit that referenced this pull request Oct 17, 2025

Test build for #3020

c7de71a

bci-pushman pushed a commit that referenced this pull request Oct 17, 2025

Test build for #3020

9ecde44

bci-pushman pushed a commit that referenced this pull request Oct 17, 2025

Test build for #3020

d45fe67

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

create non-root users for containers#3020

create non-root users for containers#3020
rcmadhankumar wants to merge 2 commits intomainfrom
non-root-users-creation

rcmadhankumar commented Oct 7, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

alexandrevicenzi Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rcmadhankumar commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexandrevicenzi Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rcmadhankumar commented Oct 7, 2025 •

edited

Loading

github-actions Bot commented Oct 7, 2025 •

edited

Loading

github-actions Bot commented Oct 7, 2025 •

edited

Loading

github-actions Bot commented Oct 7, 2025 •

edited

Loading