eSlider
d3ccd6f94e
Add docs/adr/ with a chronological ADR set reconstructed from the project history (no orchestrator, one storage format, derived-state sync, SQL-over-SSH contract, WireGuard beneath SSH, IaC boundaries, non-root image, runtime data paths, bounded lake scans), an index README, and a template. Distinguish repo-local ADRs from ecosystem-wide ASRs. Expand AGENTS.md with a decision-records section and a runtime/operations guide (service URLs, rebuild workflow, CPU budget knobs). Reference the ADRs from README, CONTRIBUTING, and the affected design docs, and add an open question for T1 partition pruning.
1008 B
1008 B
ADR-0007: Run the simulator image as a non-root user
Status
Accepted (2026-07-08)
Context
The Trivy scan in CI flagged DS-0002: the simulator image ran as root
because no USER was set. A container writing the data lake as root also
produces root-owned Parquet on bind mounts, which then blocks a later non-root
process from the same files.
Decision
Create a dedicated unprivileged user swarm (uid/gid 10001) in the
simulator/Dockerfile and switch to it with USER swarm before the entrypoint.
The uid is fixed (not auto-assigned) so host-side ownership of the shared data
paths (ADR-0008) is deterministic.
Consequences
- Trivy DS-0002 clears; the image follows least-privilege.
- Bind-mounted data is owned by
10001:10001; host prep (sim-cluster.yml) and Ansiblechownthevar/t1/var/t3paths to this uid so k3d pods can write. - Any future service image reusing this data must run as the same uid or share the group.