Cloudsql-proxy: [v1.17] Unable to use `runAsNonRoot: true` or specify custom user when deploying to Kubernetes

[kurtisvg]

Bug Description

In #321, we switched from using gcr.io/distroless/base to gcr.io/distroless/base-debian10:nonroot for the best container. This has the unintended side effect of making the container somewhat fussy about which user it's allow to run as when deployed to k8s.

Example code (or command)

Example 1:

securityContext:
     runAsNonRoot: true

Example 2:

securityContext:
    runAsUser: 2
    fsGroup: 2

Stacktrace

Example 1:

Error: container has runAsNonRoot and image has non-numeric user (nonroot), cannot verify user is non-root

Example 2:

Error: failed to start container "myapp-sql": Error response from daemon: OCI runtime create failed: container_linux.go:345: starting container process caused "chdir to cwd (\"/home/nonroot\") set in config.json failed: permission denied": unknown

Workaround

The issue can be solved by manually specifying the numeric user_id:

securityContext:
  runAsNonRoot: true
  runAsUser: 65532
  runAsGroup: 65532

Potential Solutions

Solution 1

Revert to using gcr.io/distroless/base as the base image. We can provide a separate nonroot image for users to use for additional security.

Pros: This has the advantage the the user can whatever uid they prefer (_note:_ unclear if this is necessary)

Cons: This provides a less secure option by default.

Solution 2

Specify the numeric uid instead of nonroot in the dockerfile.

Pros: This provides a more secure path by default.

Cons: Users won't be able to specify a user outside of nonroot or runAsUser: 655532

[wwuck]

I'm seeing the same issue when trying to start v1.17 inside a Container-Optimized OS Compute Engine instance. It runs fine on v1.16.

Running with the following command:

docker run -d -v /mnt/stateful_partition/cloudsql:/cloudsql gcr.io/cloudsql-docker/gce-proxy:1.17 /cloud_sql_proxy -dir=/cloudsql -instances=<instance_id> -ip_address_types=PRIVATE

gives the log output:

2020/05/13 11:58:25 current FDs rlimit set to 1048576, wanted limit is 8500. Nothing to do here.
2020/05/13 11:58:26 errors parsing config:
    mkdir /cloudsql/<instance_id>: permission denied

What is the workaround for docker on Container-Optimized OS?

[kurtisvg]

@wwuck You need to make sure you've given non-root users permission to rw in /cloudsql:
chmod a+rw /cloudsql

[wwuck]

Thanks @kurtisvg. I got it working with chmod a+rw /mnt/stateful_partition/cloudsql. I also got it working with chown 65532:65532 /mnt/stateful_partition/cloudsql so I don't need to have that directory global RW.

[VengefulAncient]

Just a correction to the workaround: runAsUser: 65534 should be runAsUser: 65532. The error still happens with 65534. Please edit the bug description if possible so that users who come to this thread to grab the workaround get the working one straight away :)

[kurtisvg]

Thanks - typo on my part, I've updated the original issue

[kurtisvg]

Given no major objections or other information surfacing, I'm going go with option 2.