Run hgweb container as non-root - #2593
Open
hahn-kev-bot wants to merge 1 commit into
Open
Conversation
Apache kept its PID file, mod_wsgi socket, mod_cgid socket, and mutexes under /usr/local/apache2/logs (root-owned), so the container couldn't start as a non-root UID. Chown that dir to www-data and set USER www-data in the image. Add runAsUser/runAsGroup/runAsNonRoot at the pod level in the hg deployment (alongside the existing fsGroup: 33), and drop the now-redundant container-level securityContext on hgresumable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
the
📦 Lexbox
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
rmunn
approved these changes
Aug 24, 2026
rmunn
left a comment
rmunn
left a comment
Contributor
There was a problem hiding this comment.
LGTM. I don't see any omissions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
we really should be running hgweb as non root, there were some issues but claude worked them out.
AI summary
The
hgwebcontainer previously ran as root. It failed to start when forced to a non-root UID — not because of a privileged port (it listens on the unprivileged 8088), but because thehttpd:2.4-bookwormbase image keeps its runtime state under/usr/local/apache2/logs, which is root-owned. As UID 33 (www-data), Apache couldn't create its PID file, the mod_wsgi socket (WSGISocketPrefix logs/wsgi), the mod_cgid socket, or its file-based mutexes, so startup aborted.Changes:
hgweb/Dockerfile—chown/usr/local/apache2/logstowww-dataand addUSER www-data, so the image runs non-root everywhere (CI, Tilt, k8s).deployment/base/hg-deployment.yaml— addrunAsUser/runAsGroup: 33andrunAsNonRoot: trueat the pod level (alongside the existingfsGroup: 33), and drop the now-redundant container-levelsecurityContextonhgresumable.Repo writes to the shared PVC were already fine: the pod has
fsGroup: 33, and thepopulate-test-reposinit container already runs as UID 33.chg(used by the/command/CGI) needs no config — its socket defaults into/tmp.This follows the earlier move of the sibling
hgresumablecontainer to www-data (#2590).Test plan
Verified locally by building the image and running it rootless (no k8s):
uid=33(www-data).logs/with no permission errors./command/x/healthzreturns 200 (mod_cgid socket works under UID 33).chg versionruns successfully as UID 33.Remaining check for a reviewer: deploy to a dev cluster and confirm the
hgpod'shgwebcontainer reaches Ready with the real PVC mounted.