Enhance security in Docker build and agent API configurations#634
Open
Enhance security in Docker build and agent API configurations#634
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded non-root verification to multiple build workflows, hardened agent pod securityContext and writable emptyDir mounts, and updated .gitignore to ignore Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@deployments/helm-charts/wso2-amp-build-extension/templates/cluster-workflow-templates/docker-buildpack-build.yaml`:
- Around line 44-63: The current non-root check only rejects empty, "0" or
"root" but misses colon-separated forms like "0:0" or "root:docker"; update the
verification logic that reads IMAGE_USER (from the podman inspect call that sets
IMAGE_USER) to treat any value whose user part (the substring before a ":" if
present) is "0" or "root" as root—e.g., split on ":" or use a regex to test
^(0|root)(:|$) and fail if matched—and keep the existing empty check; then
copy/apply this same verification block (the IMAGE_USER check that runs after
podman inspect and before podman save) into the other buildpack templates (the
google-buildpack-build.yaml and balleina-buildpack-build.yaml) so they perform
the same non-root validation prior to their podman save steps.
In
`@deployments/helm-charts/wso2-amp-platform-resources-extension/templates/component-types/agent-api.yaml`:
- Around line 152-153: The pod securityContext currently sets runAsNonRoot in
the securityContext block (see securityContext: runAsNonRoot: true) but is
missing the required runAsUser and fsGroup; update the same securityContext to
include runAsUser: 65534 and fsGroup: 65534 so the pod explicitly runs as the
nobody UID and files on mounted volumes are group-owned correctly — add these
two fields alongside runAsNonRoot in the securityContext for the pod spec.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1fe735b7-b56f-4daf-85a2-0d2602ce7d02
📒 Files selected for processing (3)
.gitignoredeployments/helm-charts/wso2-amp-build-extension/templates/cluster-workflow-templates/docker-buildpack-build.yamldeployments/helm-charts/wso2-amp-platform-resources-extension/templates/component-types/agent-api.yaml
...ts/wso2-amp-build-extension/templates/cluster-workflow-templates/docker-buildpack-build.yaml
Show resolved
Hide resolved
...s/helm-charts/wso2-amp-platform-resources-extension/templates/component-types/agent-api.yaml
Show resolved
Hide resolved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Resolves #523
Goals
Approach
User stories
Release note
Documentation
Training
Certification
Marketing
Automation tests
Security checks
Samples
Related PRs
Migrations (if applicable)
Test environment
Learning
Summary by CodeRabbit
Chores
Security