Skip to content

NON-ROOT image #876

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NeptuneHub wants to merge 1 commit into
base: main
Choose a base branch
from
Open

NON-ROOT image #876

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,10 +553,21 @@
# Point numba to /tmp so it always has write access (issue: NeptuneHub/AudioMuse-AI#479).
ENV NUMBA_CACHE_DIR=/tmp/numba_cache

ENV PYTHONPYCACHEPREFIX=/tmp/pycache \
XDG_CACHE_HOME=/tmp/.cache \
CUPY_CACHE_DIR=/tmp/cupy_cache

ENV PYTHONPATH=/usr/local/lib/python3/dist-packages:/app

RUN getent passwd 1000 && getent group 1000 || { echo "ERROR: base image has no uid/gid 1000"; exit 1; }

Check warning on line 562 in Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Merge this RUN instruction with the consecutive ones. 


See more on https://sonarcloud.io/project/issues?id=NeptuneHub_AudioMuse-AI&issues=AaA4F7nUsUjkw_C3oOrX&open=AaA4F7nUsUjkw_C3oOrX&pullRequest=876

RUN mkdir -p /app/temp_audio /app/ivf_cache /app/backup /app/plugin/installed /workspace && \
chown -R 1000:1000 /app/temp_audio /app/ivf_cache /app/backup /app/plugin/installed /workspace && \
chown 1000:1000 /app/model

EXPOSE 8000

WORKDIR /workspace
USER 1000:1000
ENTRYPOINT ["/app/docker-entrypoint.sh"]
CMD []
8 changes: 2 additions & 6 deletions deployment/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,9 +147,7 @@ spec:
component: flask
spec:
securityContext:
runAsUser: 0 # Or a non-root user if your image supports it
runAsGroup: 0 # Added fsGroup for consistency if needed by volumes
fsGroup: 0
fsGroup: 1000
containers:
- name: flask-app
image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR
Expand Down Expand Up @@ -283,9 +281,7 @@ spec:
component: worker
spec:
securityContext:
runAsUser: 0
runAsGroup: 0
fsGroup: 0
fsGroup: 1000
containers:
- name: queue-worker
image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR
Expand Down
Loading