Dockerfile incompatible with OpenShift dynamic UID allocation and security constraints

[edsoncsouza]

What is currently missing?

The current Dockerfile does not adhere to the updated best practices outlined in the Support arbitrary user ids, specifically regarding dynamic User ID (UID) allocation. OpenShift assigns arbitrary UIDs to containers to enhance security, and the current Dockerfile lacks the necessary configurations to handle these dynamic UIDs properly. Without these adjustments, the container may fail to run as intended in an OpenShift environment.

How could this be improved?

To align the Dockerfile with the updated OpenShift best practices for dynamic UID handling, the following improvements are proposed:

Dynamic UID Handling: Modify file and directory permissions to ensure compatibility with OpenShift's dynamic UID allocation. Specifically, use commands like RUN chgrp -R 0 /opt/karapace && chmod -R g+rwX to ensure that the container user, which is always part of the root group, has appropriate read and write permissions. Additionally, add the user 'karapace' to group '0' to provide the necessary permissions for accessing and modifying directories such as /opt/karapace and others as needed. This allows the container to run without requiring root privileges while ensuring that necessary files and directories are accessible.

These changes will ensure that the Dockerfile is compatible with OpenShift's dynamic security model, allowing containers to run seamlessly without requiring elevated permissions or predefined UIDs.

Is this a feature you would work on yourself?

• I plan to open a pull request for this feature

I already have the implementation ready for review and would greatly appreciate any feedback or suggestions. My goal is to ensure that this change aligns well with project standards and OpenShift best practices.