Skip to content

Run the Gradle build as a non-root user #400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kerfern wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Run the Gradle build as a non-root user #400

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 19 additions & 8 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,20 +16,31 @@ SHELL ["/bin/bash", "-c"]
ARG GRADLE_BUILD_ARGS="-PdisableSigning=true"

# Stage 1a: Install dependencies
# Install necessary tools
COPY .sdkmanrc .
# Install necessary tools, then drop root. The base image ships a
# pre-created "ubuntu" user (uid 1000, the same one the runner stage
# below renames to "engine") — reuse it so Gradle doesn't run as root,
# which ignores POSIX permission bits and breaks tests that depend on
# them (e.g. Log4jMigrationsTest's read-only-file assertion).
RUN apt-get update\
&& apt-get install -y zip curl\
&& curl -s "https://get.sdkman.io?ci=true" | bash \
&& source "$HOME/.sdkman/bin/sdkman-init.sh" && sdk env install \
&& rm -rf /var/lib/apt/lists/*
&& rm -rf /var/lib/apt/lists/* \
&& chown ubuntu:ubuntu /app
USER ubuntu

COPY --chown=ubuntu:ubuntu .sdkmanrc .
RUN curl -s "https://get.sdkman.io?ci=true" | bash \
&& source "$HOME/.sdkman/bin/sdkman-init.sh" && sdk env install

# Stage 1b: Build the application
# Copy the entire source tree (excluding .dockerignore files), and build
# (file encoding is pinned to UTF-8 in gradle.properties)
COPY . .
RUN --mount=type=cache,target=/root/.gradle/caches,sharing=locked \
--mount=type=cache,target=/root/.gradle/wrapper,sharing=locked \
COPY --chown=ubuntu:ubuntu . .
# The cache mounts below own their own target dirs (uid/gid), but not the
# ~/.gradle parent itself — Gradle also writes ~/.gradle/native (extracted
# native-platform lib) outside either mount, so create the parent up front.
RUN mkdir -p /home/ubuntu/.gradle
RUN --mount=type=cache,target=/home/ubuntu/.gradle/caches,sharing=locked,uid=1000,gid=1000 \
--mount=type=cache,target=/home/ubuntu/.gradle/wrapper,sharing=locked,uid=1000,gid=1000 \
source "$HOME/.sdkman/bin/sdkman-init.sh" \
&& ./gradlew --no-daemon build ${GRADLE_BUILD_ARGS}

Expand Down
Loading