starred/cloudbeaver

Fork 0

mirror of https://github.com/dbeaver/cloudbeaver.git synced 2026-04-25 13:46:02 +03:00

[GH-ISSUE #349] Non-root container #95

New issue

Closed

opened 2026-03-07 20:44:46 +03:00 by kerem · 10 comments

kerem commented

2026-03-07 20:44:46 +03:00

Owner

Originally created by @gdkx6432 on GitHub (Apr 15, 2021).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/349

Hello,
I would like to run this container in enterprise plateforme kubernetes but the security office don’t let me because this container is running in root user.

So I would like to ask you to configure this container to run in non-root user. Thanks very much.
I have already try this action but there’s another command needing root action so I don’t want to bug it

Best regards,
Niaina Rand

Originally created by @gdkx6432 on GitHub (Apr 15, 2021). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/349 Hello, I would like to run this container in enterprise plateforme kubernetes but the security office don’t let me because this container is running in root user. So I would like to ask you to configure this container to run in non-root user. Thanks very much. I have already try this action but there’s another command needing root action so I don’t want to bug it Best regards, Niaina Rand

kerem

2026-03-07 20:44:46 +03:00

closed this issue
added the
deployment
label

kerem commented

2026-03-07 20:44:47 +03:00

Author

Owner

@kseniiaguzeeva commented on GitHub (Jun 1, 2021):

With regards to your question about our container, it does not require a root user. In addition, if you meant the CloudBeaver documentation, it is written for a standalone docker, not for the kubernetes.

If you have experienced any problems when you tried to run CloudBeaver, could you please provide me with more details? I will then be able to assess the situation and be able to better help you.

@kseniiaguzeeva commented on GitHub (Jun 1, 2021): With regards to your question about our container, it does not require a root user. In addition, if you meant the CloudBeaver documentation, it is written for a standalone docker, not for the kubernetes. If you have experienced any problems when you tried to run CloudBeaver, could you please provide me with more details? I will then be able to assess the situation and be able to better help you.

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@MartijnVanAndel commented on GitHub (Jun 9, 2021):

I have the same issue: running CloudBeaver on enterprise kubernetes has the following error message:
Error: container has runAsNonRoot and image will run as root

What are UID and PID used to run the container?
Or where can I find the Dockerfile to build the container?

@MartijnVanAndel commented on GitHub (Jun 9, 2021): I have the same issue: running CloudBeaver on enterprise kubernetes has the following error message: _Error: container has runAsNonRoot and image will run as root_ What are UID and PID used to run the container? Or where can I find the Dockerfile to build the container?

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@MartijnVanAndel commented on GitHub (Jun 9, 2021):

I got Cloudbeaver running in enterprise kubernetes, only without persistant storage.
The yaml to run it, looks like this:

---
apiVersion: v1
kind: Service
metadata:
  name: cloudbeaver
  labels:
    app: cloudbeaver
spec:
  ports:
    - name: cbeaver-http
      protocol: TCP
      port: 8978
      targetPort: 8978  
  selector:
    app: cloudbeaver

---
apiVersion: v1
kind: Pod
metadata:
  name: cloudbeaver
  labels:
    app: cloudbeaver
spec:
  containers:
  - name: cloudbeaver
    image: dbeaver/cloudbeaver:latest
    ports:
    - containerPort: 8978 
      name: cbeaver-http
    resources:
      limits:
        cpu: "500m"
        memory: "1024Mi"
      requests:
        cpu: "500m"
        memory: "1024Mi"

@MartijnVanAndel commented on GitHub (Jun 9, 2021): I got Cloudbeaver running in enterprise kubernetes, only without persistant storage. The yaml to run it, looks like this: ``` --- apiVersion: v1 kind: Service metadata: name: cloudbeaver labels: app: cloudbeaver spec: ports: - name: cbeaver-http protocol: TCP port: 8978 targetPort: 8978 selector: app: cloudbeaver --- apiVersion: v1 kind: Pod metadata: name: cloudbeaver labels: app: cloudbeaver spec: containers: - name: cloudbeaver image: dbeaver/cloudbeaver:latest ports: - containerPort: 8978 name: cbeaver-http resources: limits: cpu: "500m" memory: "1024Mi" requests: cpu: "500m" memory: "1024Mi" ```

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@kseniiaguzeeva commented on GitHub (Jul 8, 2021):

Sorry for the long answer and thank you for the report. We will investigate it to assess the issue.

@kseniiaguzeeva commented on GitHub (Jul 8, 2021): Sorry for the long answer and thank you for the report. We will investigate it to assess the issue.

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@pha91 commented on GitHub (Aug 18, 2021):

@MartijnVanAndel
Have you tried to add a new user and run the container as this one?
Just have a look at our fix ;)

FROM dbeaver/cloudbeaver:21.1.2
RUN addgroup --gid 6000 --system cloudbeaver && adduser --disabled-password --uid 6000 --gid 6000 --gecos '' cloudbeaver
USER 6000

after that, we've configured the security context to run as this user:

podSecurityContext 
  fsGroup: 6000
  runAsUser: 6000
  runAsGroup: 6000

@pha91 commented on GitHub (Aug 18, 2021): @MartijnVanAndel Have you tried to add a new user and run the container as this one? Just have a look at our fix ;) ```docker FROM dbeaver/cloudbeaver:21.1.2 RUN addgroup --gid 6000 --system cloudbeaver && adduser --disabled-password --uid 6000 --gid 6000 --gecos '' cloudbeaver USER 6000 ```` after that, we've configured the security context to run as this user: ``` podSecurityContext fsGroup: 6000 runAsUser: 6000 runAsGroup: 6000 ```

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@MartijnVanAndel commented on GitHub (Aug 23, 2021):

@MartijnVanAndel
Have you tried to add a new user and run the container as this one?
Just have a look at our fix ;)

Hi @pha91,

The fix is working out. I got cloudbeaver running with persistant storage as a statefulset.
I had to make small adjustments in the image to fix CVE-2021-33910.

FROM dbeaver/cloudbeaver:21.1.2
RUN addgroup --gid 6000 --system cloudbeaver && adduser --disabled-password --uid 6000 --gid 6000 --gecos '' cloudbeaver
RUN apt-get update && apt-get install -yq --no-install-recommends \
  libsystemd0 \
  libudev1
USER 6000

after this I could successfully run cloudbeaver as statefulset on port 8080:

---
apiVersion: v1
kind: Service
metadata:
  name: cloudbeaver
  labels:
    app: cloudbeaver
spec:
  ports:
    - name: cbeaver-http
      protocol: TCP
      port: 8080
      targetPort: 8978  
  selector:
    app: cloudbeaver
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cloudbeaver
  labels:
    app: cloudbeaver
spec:
  selector:
    matchLabels:
      app: cloudbeaver
  serviceName: cloudbeaver
  volumeClaimTemplates:
    - metadata:
        name: cloudbeaver-data
        labels:
          app: cloudbeaver
      spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 1Gi
  template:
    metadata:
      labels:
        app: cloudbeaver
    spec:
      containers:
      - name: cloudbeaver
        image: _{built_image_from_container_repository}_:latest
        ports:
        - containerPort: 8978
          name: cbeaver-http
        volumeMounts:
        - name: cloudbeaver-data
          mountPath: /opt/cloudbeaver/workspace
        resources:
          limits:
            cpu: "500m"
            memory: "1024Mi"
          requests:
            cpu: "500m"
            memory: "1024Mi"
        securityContext:        
          runAsUser: 6000
          runAsGroup: 6000

@MartijnVanAndel commented on GitHub (Aug 23, 2021): > @MartijnVanAndel > Have you tried to add a new user and run the container as this one? > Just have a look at our fix ;) Hi @pha91, The fix is working out. I got cloudbeaver running with persistant storage as a statefulset. I had to make small adjustments in the image to fix [CVE-2021-33910](https://avd.aquasec.com/nvd/cve-2021-33910). ``` FROM dbeaver/cloudbeaver:21.1.2 RUN addgroup --gid 6000 --system cloudbeaver && adduser --disabled-password --uid 6000 --gid 6000 --gecos '' cloudbeaver RUN apt-get update && apt-get install -yq --no-install-recommends \ libsystemd0 \ libudev1 USER 6000 ``` after this I could successfully run cloudbeaver as statefulset on port 8080: ``` --- apiVersion: v1 kind: Service metadata: name: cloudbeaver labels: app: cloudbeaver spec: ports: - name: cbeaver-http protocol: TCP port: 8080 targetPort: 8978 selector: app: cloudbeaver --- apiVersion: apps/v1 kind: StatefulSet metadata: name: cloudbeaver labels: app: cloudbeaver spec: selector: matchLabels: app: cloudbeaver serviceName: cloudbeaver volumeClaimTemplates: - metadata: name: cloudbeaver-data labels: app: cloudbeaver spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi template: metadata: labels: app: cloudbeaver spec: containers: - name: cloudbeaver image: _{built_image_from_container_repository}_:latest ports: - containerPort: 8978 name: cbeaver-http volumeMounts: - name: cloudbeaver-data mountPath: /opt/cloudbeaver/workspace resources: limits: cpu: "500m" memory: "1024Mi" requests: cpu: "500m" memory: "1024Mi" securityContext: runAsUser: 6000 runAsGroup: 6000 ```

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@kseniiaguzeeva commented on GitHub (Apr 13, 2022):

I have noticed that you have not updated your ticket for a long time. If you wish to reopen this ticket, please feel free to contact me.

@kseniiaguzeeva commented on GitHub (Apr 13, 2022): I have noticed that you have not updated your ticket for a long time. If you wish to reopen this ticket, please feel free to contact me.

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@DashrathMundkar commented on GitHub (Feb 12, 2024):

Hi I tried above solution but when I start the deplyoment on kubernetes I got below error

cannot create regular file 'workspace/GlobalConfiguration/.dbeaver/data-sources.json': Read-only file system and Parent of resource: /opt/cloudbeaver/workspace/GlobalConfiguration/.project is marked as read-only anyone faced this issue?

@DashrathMundkar commented on GitHub (Feb 12, 2024): Hi I tried above solution but when I start the deplyoment on kubernetes I got below error `cannot create regular file 'workspace/GlobalConfiguration/.dbeaver/data-sources.json': Read-only file system` and `Parent of resource: /opt/cloudbeaver/workspace/GlobalConfiguration/.project is marked as read-only` anyone faced this issue?

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@EvgeniaBzzz commented on GitHub (Feb 12, 2024):

Hi @DashrathMundkar!
To ensure proper functionality of CloudBeaver, it requires write access to the /opt/cloudbeaver/workspace folder and to all child files/folders.

@EvgeniaBzzz commented on GitHub (Feb 12, 2024): Hi @DashrathMundkar! To ensure proper functionality of CloudBeaver, it requires write access to the /opt/cloudbeaver/workspace folder and to all child files/folders.

kerem commented

2026-03-07 20:44:48 +03:00

Author

Owner

@DashrathMundkar commented on GitHub (Feb 12, 2024):

Hi @DashrathMundkar! To ensure proper functionality of CloudBeaver, it requires write access to the /opt/cloudbeaver/workspace folder and to all child files/folders.

Do you have any example ? I tried this but no success

FROM dbeaver/cloudbeaver:23.3.4
USER root
RUN groupadd cloudbeaver
RUN useradd -ms /bin/bash -g cloudbeaver cloudbeaver
RUN chown -R cloudbeaver ./
RUN chmod 777 /
RUN chown -R cloudbeaver /opt/cloudbeaver
RUN chmod 777 /opt/cloudbeaver/workspace
USER cloudbeaver

Then in deployment file

securityContext:
  runAsUser: 1001

still no success

@DashrathMundkar commented on GitHub (Feb 12, 2024): > Hi @DashrathMundkar! To ensure proper functionality of CloudBeaver, it requires write access to the /opt/cloudbeaver/workspace folder and to all child files/folders. Do you have any example ? I tried this but no success ``` FROM dbeaver/cloudbeaver:23.3.4 USER root RUN groupadd cloudbeaver RUN useradd -ms /bin/bash -g cloudbeaver cloudbeaver RUN chown -R cloudbeaver ./ RUN chmod 777 / RUN chown -R cloudbeaver /opt/cloudbeaver RUN chmod 777 /opt/cloudbeaver/workspace USER cloudbeaver ``` Then in deployment file ``` securityContext: runAsUser: 1001 ``` still no success