2 ms·
Run it in a container. Don't let the container run as root - create an account which has the same ID as a dummy account on your host system. If you have to volu
by raffraffraff 5y ago
Run it in a container. Don't let the container run as root - create an account which has the same ID as a dummy account on your host system. If you have to volume mount, be very explicit about what paths you mount and use the read only flag if it makes sense. If you can't mount read only because you need to write to certain files, then grant the container account access to those files using ACLs (eg: on Linux user 'chmod' or 'setfacl').
- lmarcos 5y agoRunning it as user nobody within the container should be enough, no?
- raffraffraff 5y agoThat should do it, as long as both host and container systems implement the nobody user on the same ID. Which is likely. But I'd check all the same