From 57cedd73f28149b59f0b36a9b9134827aedcc4b9 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <kevin_hahn@sil.org>
Date: Mon, 24 Aug 2026 14:10:43 +0700
Subject: [PATCH] Run hgweb container as non-root (www-data)

Apache kept its PID file, mod_wsgi socket, mod_cgid socket, and mutexes
under /usr/local/apache2/logs (root-owned), so the container couldn't
start as a non-root UID. Chown that dir to www-data and set USER www-data
in the image.

Add runAsUser/runAsGroup/runAsNonRoot at the pod level in the hg
deployment (alongside the existing fsGroup: 33), and drop the now-redundant
container-level securityContext on hgresumable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 deployment/base/hg-deployment.yaml |  7 +++----
 hgweb/Dockerfile                   | 10 ++++++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/deployment/base/hg-deployment.yaml b/deployment/base/hg-deployment.yaml
index e116b6818c..3dc1142bf6 100644
--- a/deployment/base/hg-deployment.yaml
+++ b/deployment/base/hg-deployment.yaml
@@ -80,6 +80,9 @@ spec:
     spec:
       securityContext:
         fsGroup: 33
+        runAsGroup: 33 #www-data
+        runAsUser: 33
+        runAsNonRoot: true
 
       containers:
       - name: hgweb
@@ -158,10 +161,6 @@ spec:
             memory: 400Mi
         ports:
           - containerPort: 8080
-        securityContext:
-          runAsGroup: 33 #www-data
-          runAsUser: 33
-          runAsNonRoot: true
 
         env:
           - name: URLS
diff --git a/hgweb/Dockerfile b/hgweb/Dockerfile
index 25f9a1216f..4366814c14 100644
--- a/hgweb/Dockerfile
+++ b/hgweb/Dockerfile
@@ -39,6 +39,12 @@ COPY opentelemetry_module.conf /usr/local/apache2/conf/
 # Ensure /var/hg and /var/hg/repos are owned by www-data user
 RUN install -d /var/hg/repos -o www-data -g www-data
 
+# Make Apache's runtime dir writable by www-data so the container can run as
+# non-root. Apache keeps its PID file, mod_wsgi socket (WSGISocketPrefix
+# logs/wsgi), mod_cgid socket, and file-based mutexes under this dir; without
+# this, startup fails as UID 33.
+RUN chown -R www-data:www-data /usr/local/apache2/logs
+
 # Configure hgweb
 COPY hgweb.hgrc /var/hg/
 COPY hgweb.wsgi /usr/local/www/wsgi-scripts/
@@ -50,3 +56,7 @@ VOLUME /var/hg/repos
 ARG APP_VERSION
 ENV APP_VERSION=$APP_VERSION
 ENV OTEL_RESOURCE_ATTRIBUTES_FROM_BUILD="service.name=hgweb,service.version=${APP_VERSION}"
+
+# Run as an unprivileged user. hgweb listens on 8088 (unprivileged), so no
+# root-only startup step remains.
+USER www-data