Don't change USER instruction in CBL Mariner distroless

dotnet · Mar 22, 2023 · 2d48ef9 · 2d48ef9
1 parent 90a520d
commit 2d48ef9
Show file tree

Hide file tree

Showing 9 changed files with 16 additions and 9 deletions.
diff --git a/eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner b/eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner
@@ -69,4 +69,4 @@ COPY --from=installer --chown={{uid}}:{{gid}} {{distrolessStagingDir}}/home/{{us
     "uid": uid
 ])}}
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/6.0/cbl-mariner1.0-distroless/amd64/Dockerfile b/src/runtime-deps/6.0/cbl-mariner1.0-distroless/amd64/Dockerfile
@@ -59,4 +59,4 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/6.0/cbl-mariner2.0-distroless/amd64/Dockerfile b/src/runtime-deps/6.0/cbl-mariner2.0-distroless/amd64/Dockerfile
@@ -70,4 +70,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/6.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile b/src/runtime-deps/6.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile
@@ -70,4 +70,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/7.0/cbl-mariner2.0-distroless/amd64/Dockerfile b/src/runtime-deps/7.0/cbl-mariner2.0-distroless/amd64/Dockerfile
@@ -73,4 +73,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/7.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile b/src/runtime-deps/7.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile
@@ -73,4 +73,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/8.0/cbl-mariner2.0-distroless/amd64/Dockerfile b/src/runtime-deps/8.0/cbl-mariner2.0-distroless/amd64/Dockerfile
@@ -74,4 +74,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/src/runtime-deps/8.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile b/src/runtime-deps/8.0/cbl-mariner2.0-distroless/arm64v8/Dockerfile
@@ -74,4 +74,4 @@ ENV \
     # Set the invariant mode since ICU package isn't included (see https://github.com/dotnet/announcements/issues/20)
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true
 
-USER $APP_UID
+USER app
diff --git a/tests/Microsoft.DotNet.Docker.Tests/ProductImageTests.cs b/tests/Microsoft.DotNet.Docker.Tests/ProductImageTests.cs
@@ -103,7 +103,14 @@ protected void VerifyCommonDefaultUser(ProductImageData imageData)
             string expectedUser;
             if (imageData.IsDistroless && ImageType != DotNetImageType.SDK)
             {
-                expectedUser = "app";
+                if (imageData.OS.Contains("cbl-mariner"))
+                {
+                    expectedUser = "app";
+                }
+                else
+                {
+                    expectedUser = imageData.NonRootUID.ToString();
+                }
             }
             // For Windows, only Nano Server defines a user, which seems wrong.
             // I've logged https://dev.azure.com/microsoft/OS/_workitems/edit/40146885 for this.