eSlider
d3ccd6f94e
Add docs/adr/ with a chronological ADR set reconstructed from the project history (no orchestrator, one storage format, derived-state sync, SQL-over-SSH contract, WireGuard beneath SSH, IaC boundaries, non-root image, runtime data paths, bounded lake scans), an index README, and a template. Distinguish repo-local ADRs from ecosystem-wide ASRs. Expand AGENTS.md with a decision-records section and a runtime/operations guide (service URLs, rebuild workflow, CPU budget knobs). Reference the ADRs from README, CONTRIBUTING, and the affected design docs, and add an open question for T1 partition pruning.
28 lines
1008 B
Markdown
28 lines
1008 B
Markdown
# ADR-0007: Run the simulator image as a non-root user
|
|
|
|
## Status
|
|
|
|
Accepted (2026-07-08)
|
|
|
|
## Context
|
|
|
|
The Trivy scan in CI flagged **DS-0002**: the simulator image ran as `root`
|
|
because no `USER` was set. A container writing the data lake as root also
|
|
produces root-owned Parquet on bind mounts, which then blocks a later non-root
|
|
process from the same files.
|
|
|
|
## Decision
|
|
|
|
Create a dedicated unprivileged user **`swarm` (uid/gid 10001)** in the
|
|
`simulator/Dockerfile` and switch to it with `USER swarm` before the entrypoint.
|
|
The uid is fixed (not auto-assigned) so host-side ownership of the shared data
|
|
paths ([ADR-0008](ADR-0008-runtime-data-paths.md)) is deterministic.
|
|
|
|
## Consequences
|
|
|
|
- Trivy DS-0002 clears; the image follows least-privilege.
|
|
- Bind-mounted data is owned by `10001:10001`; host prep (`sim-cluster.yml`) and
|
|
Ansible `chown` the `var/t1` / `var/t3` paths to this uid so k3d pods can write.
|
|
- Any future service image reusing this data must run as the same uid or share
|
|
the group.
|