Cannot run temporal services as non-root user in kubernetes

Community Support
1

We have restrictions in our enterprise k8s environment to block running containers as root user. Kubernetes also recommends running containers as non-root user - 11 Ways (Not) to Get Hacked | Kubernetes

Starting temporal containers (using the helm chart from temporal helm chart repo) as non-root user throws the below permission error:

  • dockerize -template /etc/temporal/config/config_template.yaml:/etc/temporal/config/docker.yaml
    2021/02/04 14:28:48 unable to create open /etc/temporal/config/docker.yaml: permission denied

Currently, I did a workaround by creating a custom image with permission for non-root user to /etc/temporal/ dir.

Can we update the dockerfile and helm chart to run temporal services as non-root user by default?

2

Hi Siva,

Can you create an github issue for this?

3

Done - Cannot run temporal services as non-root user in kubernetes · Issue #1263 · temporalio/temporal · GitHub. Thanks!

4

Hi @Wenquan_Xing,
Is there any timeline when this issue will be fixed? We are also facing the same problem.

5

this is on our radar and we do plan on eventually making this happen. at the same time, the work has not been scheduled yet.

but there’s no reason temporal inherently needs to run with root and we’re totally open to accepting PRs to make this possible in the meantime.

thank you for your feedback as interest in specific issues helps us to prioritize our efforts!

6

Hi @derek Is there any ETA on getting this rolled out?

7

definitely still open to PRs, no ETA.

8

Hi,
I have the same requirement to run temporal services as a non-root user and I see that the associated github issue was addressed with this PR.

I’m testing out a helm deployment using MySQL as the only dependency and I still end up with containers running as root. Looking at the helm template, I see that securityContext is preceded by
this if statement, which means that the securityContext is only added if either cassandra or elasticsearch are enabled. Could this be updated so that containers don’t run as root when using MySQL only?

9

Could this be updated so that containers don’t run as root when using MySQL only?

Yes it can be imo. Could you open issue in helm charts repo and will add.

10

Thanks, I created [Bug] Cannot run temporal services as non-root user in kubernetes · Issue #307 · temporalio/helm-charts · GitHub

11

I took a stab at addressing the issue with Run as nonRoot with Cassandra and Elasticsearch disabled by fivos · Pull Request #308 · temporalio/helm-charts · GitHub