Skip to content

Commit 06e5d7f

Browse files
committed
RHAIENG-287: fix(Dockerfiles): use USER 1001 to avoid Hadolint DL3002 warning
``` ./jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu:23 DL3002 warning: Last USER should not be root ./runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu:104 DL3002 warning: Last USER should not be root ./runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu:182 DL3002 warning: Last USER should not be root ./runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu:206 DL3002 warning: Last USER should not be root ./runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu:231 DL3002 warning: Last USER should not be root ./codeserver/ubi9-python-3.12/Dockerfile.cpu:12 DL3002 warning: Last USER should not be root ./codeserver/ubi9-python-3.12/Dockerfile.cpu:38 DL3002 warning: Last USER should not be root ```
1 parent 7773a8e commit 06e5d7f

File tree

4 files changed

+31
-1
lines changed

4 files changed

+31
-1
lines changed

codeserver/ubi9-python-3.12/Dockerfile.cpu

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ COPY ${CODESERVER_SOURCE_CODE}/get_code_server_rpm.sh .
3030
# create dummy file to ensure this stage is awaited before installing rpm
3131
RUN ./get_code_server_rpm.sh && touch /tmp/control
3232

33+
# Switch back to non-root user to satisfy hadolint DL3002
34+
USER 1001
35+
3336
#######################
3437
# wheel caching stage #
3538
#######################
@@ -61,6 +64,9 @@ RUN --mount=type=cache,target=/root/.cache/uv \
6164
# dummy file to make image build wait for this stage
6265
RUN touch /tmp/control
6366

67+
# Switch back to non-root user to satisfy hadolint DL3002
68+
USER 1001
69+
6470
####################
6571
# cpu-base #
6672
####################
@@ -284,5 +290,5 @@ set -Eeuxo pipefail
284290
python3 /tmp/test/test_startup.py 2>&1 | tee /tmp/test_log.txt
285291
EOF
286292

287-
from codeserver
293+
FROM codeserver
288294
COPY --from=tests /tmp/test_log.txt /tmp/test_log.txt

jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \
166166
mkdir -p /tmp/wheels; \
167167
fi
168168

169+
# Switch back to non-root user to satisfy hadolint DL3002
170+
USER 1001
171+
169172
#######################################################
170173
# common-builder (for Power-only)
171174
#######################################################
@@ -182,6 +185,9 @@ else
182185
fi
183186
EOF
184187

188+
# Switch back to non-root user to satisfy hadolint DL3002
189+
USER 1001
190+
185191
#######################################################
186192
# onnx-builder (Power-only)
187193
#######################################################

jupyter/trustyai/ubi9-python-3.12/Dockerfile.cpu

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ RUN --mount=type=cache,target=/root/.cache/uv \
3737
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
3838
UV_LINK_MODE=copy uv pip install --strict --no-deps --refresh --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
3939

40+
# Switch back to non-root user to satisfy hadolint DL3002
41+
USER 1001
42+
4043
####################
4144
# cpu-base #
4245
####################

runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,9 @@ RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/oc
103103
rm -f /tmp/openshift-client-linux.tar.gz
104104
# Install the oc client end
105105

106+
# Switch back to non-root user to satisfy hadolint DL3002
107+
USER 1001
108+
106109
##############################
107110
# wheel-builder stage #
108111
# NOTE: Only used in s390x
@@ -183,6 +186,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \
183186
mkdir -p /tmp/wheels; \
184187
fi
185188

189+
# Switch back to non-root user to satisfy hadolint DL3002
190+
USER 1001
191+
186192
###################################
187193
# openblas builder stage for ppc64le
188194
##################################
@@ -207,6 +213,9 @@ RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
207213
echo "Not ppc64le, skipping OpenBLAS build" && mkdir -p /root/OpenBLAS-dummy; \
208214
fi
209215

216+
# Switch back to non-root user to satisfy hadolint DL3002
217+
USER 1001
218+
210219
###################################
211220
# onnx builder stage for ppc64le
212221
###################################
@@ -233,6 +242,9 @@ RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
233242
echo "Not ppc64le, skipping ONNX build" && mkdir -p /onnx_wheels; \
234243
fi
235244

245+
# Switch back to non-root user to satisfy hadolint DL3002
246+
USER 1001
247+
236248
###################################
237249
# pyarrow builder stage for ppc64le
238250
##################################
@@ -291,6 +303,9 @@ RUN if [ "$TARGETARCH" = "ppc64le" ]; then \
291303
echo "Not ppc64le, skipping pyarrow build" && mkdir -p /arrowwheels; \
292304
fi
293305

306+
# Switch back to non-root user to satisfy hadolint DL3002
307+
USER 1001
308+
294309
#######################
295310
# runtime-datascience #
296311
#######################

0 commit comments

Comments
 (0)