Repository navigation
security(docker): run Go services without root with safe volume-permission migration #339
Description
Context
Identified by a static comparison on 2026-10-07 against dborup/CoreScope master 6444294d938083f6d935d0445c27bc6a7bbf360e. This is follow-up work for evaluation and implementation, not a claim of an observed production incident. Recheck current master before implementation. No deployment is authorized by this issue alone.
Upstream reference: Kpa-clawbot fork, PR 2125 (reference only; intentionally not linked to avoid upstream notifications)
Benefit and existing coverage
The current Go Supervisor configurations run under root without per-service user overrides. Dropping privileges limits the impact of a compromised service. This observation concerns repository container definitions, not a verification of the currently deployed processes.
Required work / acceptance criteria
- Run corescope-server and corescope-ingestor as non-root in all supported Go container variants.
- Define UID/GID behavior for existing bind mounts, named volumes and configured host IDs.
- Test new and existing root-owned databases, WAL/SHM files, config, logs and required writable paths.
- Avoid unnecessary recursive ownership changes and broad writable application directories; document startup cost and host-volume side effects.
- Preserve Mosquitto/Caddy behavior, including our existing broker PUID/PGID handling.
- Test read-only config mounts and geo-filter save behavior, with clear failures for unsupported arrangements.
- Provide migration and rollback instructions; retain backups and do not modify production permissions during development.
Upstream's entrypoint is a reference, not a drop-in migration plan.
Activity
test(docker): make the in-place toggle stats check unambiguous (#339)
test(docker): pin that root never uses files the non-root services ca…
fix(docker): never let root use files the non-root services can write (…
test(docker): off start after the non-root mode, and a stricter owner…
fix(docker): off start after the non-root mode; root-read files owned…
test(docker): full-image fixtures that match the owner rule (#339)
test(docker): pin the message for a root-read file owned by the servi…
dborup commentedon Oct 13, 2026
Opt-in non-root mode merged in #404. It is off by default, so existing installs are unchanged. This issue stays open until the staging rehearsal (checklist in #404) is done and the owner decides about production.
Merge origin/master (dd712bc) into codex/issue-339-nonroot-containers
test(docker): cover the .env trigger on a volume without the marker (#…
Merge pull request #404 from dborup/codex/issue-339-nonroot-containers
dborup commentedon Oct 14, 2026
Staging rehearsal (v0.2.4-rc2, 2026-10-14): non-root mode ran for about 2 h on real data with UID/GID 10001. Server and ingestor ran as the dedicated user, ingest was normal, and there were 0 permission/readonly/SQLITE_BUSY errors and write_errors=0. A second restart reported
ownership: 0 of 4. The rollback drill passed: with the mode off, everything ran as root immediately;restore-ownersrestored the recorded owners and modes exactly and removed.corescope-nonroot; the next start was clean. Still to test: the geo-filter save returning 409 in on-mode (needs the admin key). The production decision is pending.dborup commentedon Oct 14, 2026
Geo-filter check done on staging (2026-10-14): with non-root mode on, "Save to server" in the customizer showed "geo filter not saved: config.json is read-only for the server (read-only mount, or CORESCOPE_RUN_AS_NONROOT is on)…". The server logged
[geofilter] save failed: … CORESCOPE_RUN_AS_NONROOT is on, andconfig.jsonwas unchanged (mtime not touched). A second rollback withrestore-ownerswas clean again. Every item on the #404 staging checklist has now passed; the production decision is pending.