Semgrep: Non root docker image

[javixeneize]

Hi

The docker image for semgrep runs as root. I think a new image should be released with a less privileged user

[DrewDennison]

@javixeneize thanks for the issue. Yep I believe there shouldn't be any issue. I can investigate if this is a quick task tomorrow or it would be super appreciated if you made a PR. Does running with --user $(id -u):$(id -g) work as a temporary workaround for you? (it might dump a stack trace if file permissions need to be updated for this to work)

[javixeneize]

im trying to make it work creating a new user in the dockerfile, but even doing a chmod 777 for the semgrep binary, it still says permission denied.

Im trying to build a docker image based in alpine, running pip install, but im having the issue detailed in #1295
Im trying to build the wheel by myself and repackage everything but its a bit of pain and not pretty.... If you can let me know how to install semgrep with pip, i can do this PR easily ;)

This is how my dockerfile looks like right now

FROM python:3.7-alpine3.10
USER root
RUN apk update && apk add curl-dev gcc libc-dev openssl-dev libffi-dev shadow \
&& apk add jpeg-dev zlib-dev nmap nmap-scripts git \
&& rm -rf /var/cache/apk/*
RUN git clone https://github.com/returntocorp/semgrep.git
RUN pip install semgrep

Thats the error im having:

Copying semgrep.egg-info to build/bdist.linux-x86_64/wheel/semgrep-0.17.0.data/purelib/semgrep-0.17.0-py3.7.egg-info
running install_scripts
error: can't copy '/tmp/pip-install-ve2z2vkl/semgrep-files/semgrep-core': doesn't exist or not a regular file

---

ERROR: Failed building wheel for semgrep

[javixeneize]

I have submitted a PR to add a non root dockerfile - https://github.com/returntocorp/semgrep/pull/1443

Thanks

[brendongo]

@javixeneize not sure what you are trying to do but we currently do not have a published pip package that works on alpine. Which results in the error you are seeing above.

The following dockerfile should work:

FROM python:3.7.7
RUN pip install semgrep

[brendongo]

Alternatively you can copy the relevant binaries from our alpine docker container:

FROM returntocorp/semgrep:0.17.0 as semgrep-alpine
FROM python:3.7-alpine3.10
COPY --from=semgrep-alpine /usr/local/bin/semgrep-core /usr/local/bin/semgrep-core
COPY --from=semgrep-alpine /semgrep /semgrep
RUN HOMEBREW_SYSTEM='NOCORE' python -m pip install /semgrep
ENV SEMGREP_IN_DOCKER=1
ENV SEMGREP_VERSION_CACHE_PATH=/src/.cache/semgrep_version
ENV PYTHONIOENCODING=utf8
ENV PYTHONUNBUFFERED=1

RUN semgrep --version

to get semgrep working in your own alpine docker.

[javixeneize]

Yeah, this works, thanks!

Im trying to build semgrep as a service, it will be wrapped with a flask API and it will receive a config file, a git repository and return the report. Once i have it ready, i will do a PR if its something that you would like to have in your project

Thanks!

[dlukeomalley]

@javixeneize This project sounds awesome! Have you seen https://semgrep.dev/scan ? It has similar functionality letting you specify a config + git repository. Feel free to join us on the community slack (r2c.dev/slack) if you’d like to learn more!

[javixeneize]

Ok, i will have a look at it. It is more to call it via API rather than having that interface, but looks great :)

[dlukeomalley]

I think we're thinking the same way. We are starting to use both /scan and app.r2c.dev for on-demand scanning of public and private projects via API and for one-off cases via a UI. Would love to chat more about what you have in mind :)

[javixeneize]

Sure, let’s have a chat. I will write you tomorrow.
Thanks!