fix(security): set readOnlyRootFilesystem on bot container (RHCLOUD-50068) - #88
Open
tahmidefaz wants to merge 1 commit into
Open
tahmidefaz wants to merge 1 commit into
tahmidefaz wants to merge 1 commit into
Conversation
…0068) FIND-004: writable rootfs let executed third-party code (npm postinstall etc.) overwrite PATH binaries or persist inside the image layer. Lock the rootfs and move writable state (HOME, /tmp) to emptyDir volumes, sized within the existing ephemeral-storage limit. An init container seeds the home volume with the image's baked-in venv/bot code/config first, since a bare emptyDir mount would otherwise hide that content. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
RHCLOUD-50068 (FIND-004, from the AI security audit): the bot container's
securityContextdidn't setreadOnlyRootFilesystem: true. A fully writable root filesystem means any code executed inside the container (e.g. a malicious npm postinstall script) could overwrite binaries onPATHor drop persistence inside the container image layer — this would survive for the pod's lifetime.Changes
readOnlyRootFilesystem: trueon the bot container — this is the actual fix.homeandtmpemptyDir volumes, mounted at/home/botuserand/tmp. The bot legitimately needs writable scratch space — git clones under/home/botuser/app/repos,.gitconfig-gh/.gitconfig-gl,.credentials, temp files viamktemp. Locking the rootfs without giving it somewhere to write would break the entrypoint outright, so these paths are backed by emptyDir instead. Sized at 6Gi/2Gi to stay within the existing 8Giephemeral-storagelimit on the container.init-homeinit container: runscp -a /home/botuser/. /mnt/home/to seed the home emptyDir with the image's baked-in content (python venv, bot code,config.json,.mcp.json,entrypoint.sh, etc.) before the main container starts. Without this, mounting a bare emptyDir over/home/botuserwould hide everything baked into the image at build time and the bot would boot into an empty home directory.Net effect: same runtime behavior as before, but the container's root filesystem is now locked down and all writes are confined to the two explicit volumes.