fix: allow running as non-root #40642

wyattwalter · 2025-05-12T15:17:22Z

Description

Allows the Appsmith container to run as a non-root user, specified at runtime through either docker-compose or Kubernetes pod security context. I didn't specify the user in the Dockerfile because environments like OpenShift choose a user at runtime, so it can't be known at build time.

This needs to be followed by an update to docs and changes in the Helm chart to finish it off, but that has a separate release cycle and this needs to go ahead of that.

Ideally we would run as non-root by default, but since there's data persisted on the filesystem automatically transitioning the default is impossible without a lot of pain. This moves us in that direction and enables it in the future if we go down that path.

Required to fix #38787

Automation

/ok-to-test tags=""

🔍 Cypress test results

Warning

Tests have not run on the HEAD 50ba745 yet

Thu, 15 May 2025 15:56:31 UTC

Communication

Should the DevRel and Marketing teams inform users about this change?

Yes
No

Summary by CodeRabbit

New Features
- Added support for user identity emulation when running as a non-root user, improving compatibility in certain deployment environments.
- Prevented embedded database initialization when running as a non-root user to ensure proper operation.
Chores
- Installed additional system packages to the base image for enhanced functionality.
- Optimized image size by consolidating and improving cleanup steps during the build process.
- Updated base image and refined installation commands for improved build consistency.

coderabbitai · 2025-05-12T15:17:30Z

Walkthrough

The changes update Docker build and entrypoint scripts to improve package installation, image cleanup, and user identity handling. The base Dockerfile now installs additional packages, consolidates cleanup steps, and sets up NSS Wrapper for non-root user support. The entrypoint script configures NSS Wrapper when running as a non-root user and prevents embedded Postgres initialization in non-root mode.

Changes

Files/Paths	Change Summary
Dockerfile	Reformatted the `apt-get install` command for improved readability; logic remains unchanged.
deploy/docker/base.dockerfile	Added `libnss-wrapper` and `git` installation, consolidated cleanup steps, adjusted permissions on Redis config, set up NSS Wrapper symlink and environment variables.
deploy/docker/fs/opt/appsmith/entrypoint.sh	Added logic to configure NSS Wrapper for non-root users, moved and updated UID logging, introduced `fail_if_non_root()` to block embedded Postgres init for non-root users.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant Entrypoint Script
    participant NSS Wrapper

    User->>Entrypoint Script: Start container
    Entrypoint Script->>Entrypoint Script: Check if running as non-root
    alt Non-root user
        Entrypoint Script->>NSS Wrapper: Create temp passwd/group files with current UID/GID
        Entrypoint Script->>Entrypoint Script: Export LD_PRELOAD with NSS Wrapper symlink
    end
    Entrypoint Script->>Entrypoint Script: Log current UID
    Entrypoint Script->>Entrypoint Script: If init_postgres, call fail_if_non_root to prevent embedded DB init
    Entrypoint Script->>User: Continue application startup

Possibly related PRs

chore: update base image for appsmith #40058: Updates the base image version and upgrades database versions and key management in the same Dockerfile; both modify the base image and package setup but focus on different aspects.

Suggested labels

skip-changelog

Suggested reviewers

sharat87
nidhi-nair

Poem

In Docker’s halls, new packages arrive,
With cleanup so thorough, the images thrive.
NSS Wrapper stands ready for users not root,
Ensuring the entrypoint’s logic stays astute.
With tidy commands and a symlink in tow,
The container’s identity is ready to go!
🐳✨

Note

⚡️ AI Code Reviews for VS Code, Cursor, Windsurf

CodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback.
Learn more here.

Note

⚡️ Faster reviews with caching

CodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure Review - Disable Cache at either the organization or repository level. If you prefer to disable all data retention across your organization, simply turn off the Data Retention setting under your Organization Settings.
Enjoy the performance boost—your workflow just got faster.

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro (Legacy)

📥 Commits

Reviewing files that changed from the base of the PR and between c0b3db2 and 0616138.

📒 Files selected for processing (1)

deploy/docker/fs/opt/appsmith/entrypoint.sh (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

deploy/docker/fs/opt/appsmith/entrypoint.sh

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

wyattwalter · 2025-05-12T15:19:56Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T15:20:21Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14976096450.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-12T15:25:38Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-12T15:52:59Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T15:53:24Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14976813608.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-12T15:58:37Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-12T19:05:34Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T19:06:00Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980450347.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

wyattwalter · 2025-05-12T19:08:41Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T19:09:04Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980505949.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-12T19:16:48Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-12T19:25:31Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T19:25:55Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14980819023.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-12T19:32:15Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-12T20:29:36Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-12T20:29:57Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/14981979160.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-12T20:36:25Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-13T19:33:58Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-13T19:34:19Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15005175710.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-13T19:50:47Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

github-actions · 2025-05-14T21:37:59Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-14T21:49:00Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-14T21:49:22Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15031794549.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-14T21:54:48Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-15T15:08:54Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-15T15:09:21Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15048572151.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-15T15:15:34Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-15T15:24:13Z

/build-deploy-preview skip-tests=true

github-actions · 2025-05-15T15:24:40Z

Deploying Your Preview: https://github.com/appsmithorg/appsmith/actions/runs/15048924049.
Workflow: On demand build Docker image and deploy preview.
skip-tests: true.
env: ``.
PR: 40642.
recreate: .

github-actions · 2025-05-15T15:31:03Z

Deploy-Preview-URL: https://ce-40642.dp.appsmith.com

wyattwalter · 2025-05-15T15:57:23Z

deploy/docker/base.dockerfile

-
-RUN mv /opt/caddy/caddy /opt/caddy/caddy_vanilla
+    | tar -xz -C /opt/caddy && \
+  mv /opt/caddy/caddy /opt/caddy/caddy_vanilla


This removed an extra layer, removing ~50MB from the image.

github-actions · 2025-05-22T16:40:14Z

This PR has not seen activitiy for a while. It will be closed in 7 days unless further activity is detected.

## Description Allows the Appsmith container to run as a non-root user, specified at runtime through either docker-compose or Kubernetes pod security context. I didn't specify the user in the `Dockerfile` because environments like OpenShift choose a user at runtime, so it can't be known at build time. This needs to be followed by an update to docs and changes in the Helm chart to finish it off, but that has a separate release cycle and this needs to go ahead of that. Ideally we would run as non-root by default, but since there's data persisted on the filesystem automatically transitioning the default is impossible without a lot of pain. This moves us in that direction and enables it in the future if we go down that path. Required to fix #38787 ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!WARNING] > Tests have not run on the HEAD 50ba745 yet > <hr>Thu, 15 May 2025 15:56:31 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit - **New Features** - Added support for user identity emulation when running as a non-root user, improving compatibility in certain deployment environments. - Prevented embedded database initialization when running as a non-root user to ensure proper operation. - **Chores** - Installed additional system packages to the base image for enhanced functionality. - Optimized image size by consolidating and improving cleanup steps during the build process. - Updated base image and refined installation commands for improved build consistency.

## Description Allows the Appsmith container to run as a non-root user, specified at runtime through either docker-compose or Kubernetes pod security context. I didn't specify the user in the `Dockerfile` because environments like OpenShift choose a user at runtime, so it can't be known at build time. This needs to be followed by an update to docs and changes in the Helm chart to finish it off, but that has a separate release cycle and this needs to go ahead of that. Ideally we would run as non-root by default, but since there's data persisted on the filesystem automatically transitioning the default is impossible without a lot of pain. This moves us in that direction and enables it in the future if we go down that path. Required to fix #38787 ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!WARNING] > Tests have not run on the HEAD 50ba745 yet > <hr>Thu, 15 May 2025 15:56:31 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit - **New Features** - Added support for user identity emulation when running as a non-root user, improving compatibility in certain deployment environments. - Prevented embedded database initialization when running as a non-root user to ensure proper operation. - **Chores** - Installed additional system packages to the base image for enhanced functionality. - Optimized image size by consolidating and improving cleanup steps during the build process. - Updated base image and refined installation commands for improved build consistency.  ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="" ### :mag: Cypress test results  > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR.  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No Co-authored-by: Wyatt Walter <wyattwalter@gmail.com>

## Description Requires: #40642 Adds an environment variable activating nss_wrapper when the `securityPolicy.runAsUser` value is set so the UID can be set dynamically. This avoids the `I have no name!` in the prompt when doing a `kubectl exec` with that value set. I am also introducing [helm-unittest](https://github.com/helm-unittest/helm-unittest) for ensuring that changes to our defaults are made explicit. Fixes #38787 ## Automation /ok-to-test tags="" ### 🔍 Cypress test results  > [!WARNING] > Tests have not run on the HEAD d30d87f yet > <hr>Mon, 19 May 2025 18:59:10 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No  ## Summary by CodeRabbit - **New Features** - Added automated unit testing for Helm charts, including snapshot and security context tests. - Introduced documentation for running and understanding Helm chart unit tests. - Added a GitHub Actions workflow to run Helm chart unit tests on pull requests and manually. - **Bug Fixes** - Ensured the LD_PRELOAD environment variable is set when a specific security context is configured in deployments. - **Documentation** - Updated Helm chart README to reference new testing documentation and improve clarity.  --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Goutham Pratapa <goutham@appsmith.com>

fix: allow running as non-root

fba4e7e

github-actions bot added the Bug Something isn't working label May 12, 2025

wrong path

574bec0

make kubectl exec work

7e77b9d

wrong path

04487fa

create tmp directory first

949b2ac

add to bashrc instead

7489a16

try it via profile.d

57a0f62

simplify this

3f103f9

everything besides postges works

cf49f8a

fix issue with container restarts

c0b3db2

wrong logic on embedded postgres if

0616138

put main dockerfile back

50ba745

wyattwalter commented May 15, 2025

View reviewed changes

github-actions bot added Community Reported issues reported by community members DevOps Pod Issues related to devops K8s Kubernetes related issues Medium Issues that frustrate users due to poor UX Needs Triaging Needs attention from maintainers to triage Production labels May 15, 2025

wyattwalter mentioned this pull request May 16, 2025

fix: support nss wrapper in Helm chart #40673

Merged

2 tasks

github-actions bot added the Stale label May 22, 2025

pratapaprasanna merged commit 2d21717 into release May 28, 2025
24 checks passed

pratapaprasanna deleted the ww-fix-non-root-user branch May 28, 2025 16:49

wyattwalter mentioned this pull request May 29, 2025

chore: remove git install from main dockerfile #40807

Closed

2 tasks

fix: allow running as non-root #40642

fix: allow running as non-root #40642

Uh oh!

Conversation

wyattwalter commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Automation

🔍 Cypress test results

Communication

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

Documentation and Community

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

github-actions bot commented May 12, 2025

Uh oh!

wyattwalter commented May 13, 2025

Uh oh!

github-actions bot commented May 13, 2025

Uh oh!

github-actions bot commented May 13, 2025

Uh oh!

github-actions bot commented May 14, 2025

Uh oh!

wyattwalter commented May 14, 2025

Uh oh!

github-actions bot commented May 14, 2025

Uh oh!

github-actions bot commented May 14, 2025

Uh oh!

wyattwalter commented May 15, 2025

Uh oh!

github-actions bot commented May 15, 2025

Uh oh!

github-actions bot commented May 15, 2025

wyattwalter commented May 12, 2025 •

edited

Loading

coderabbitai bot commented May 12, 2025 •

edited

Loading