如何在 Fargate 上的 Amazon ECS 中以非 root 用户身份运行 docker 容器

Question

A non-root user can run docker containers by using USER instruction.
reference: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user

I want to do that in Amazon ECS on Fargate.

How does a non-root user run docker containers in Amazon ECS on Fargate?

Thank you in advance.

Answer 1

If you happen to manage the Dockerfile, you may just include the USER directive to it to prevent the resulting container from running as root. You may also create an ad-hoc Dockerfile with the FROM instruction pointing to the image you want to run as non-root, and the USER directive. All these require using a Dockerfile and building the image on your own.

The other alternatives are removing the shell, which is something you could do after the container starts using rm , but this is a very basic mitigation that won't prevent from accessing sensible data in the container.

Finally, if using Kubernetes there is a policy to run as user or group. I will directly paste the fragment of my source for this answer: AWS - EKS Best Practices Guide

The Kubernetes podSpec includes a set of fields under spec.securityContext , that allow to let you specify the user and/or group to run your application as. These fields are runAsUser and runAsGroup respectively. You can mandate the use of these fields by creating a pod security policy. See https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups for further information on this topic.

Answer 2

在 Amazon ECS 中将容器映像作为 Fargate 任务运行时，有参数“user”、“privileged”，如下所述： https : //docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html用于指定用于运行容器的用户。