ci: drop running COSA as UID 0 #3562
Conversation
|
Skipping CI for Draft Pull Request. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request removes the need to run the COSA container as UID 0, which is a good security improvement. However, the new container image specified uses the :latest tag and appears to be from a personal repository. For build reproducibility and long-term maintenance, it's highly recommended to switch to an official image with a specific version tag.
dustymabe
force-pushed
the
dusty-uid-0
branch
from
5b97663 to
0a06f65
Compare
|
Unrelated to this PR (I think) there are 3 tests that are failing that need some investigation: |
ok - now that all the PRs merged against COSA the only remaining test failure is: So I guess that's the only one that needs to be investigated. |
dustymabe
force-pushed
the
dusty-uid-0
branch
from
0a06f65 to
c40b07f
Compare
With some changes made upstream to COSA [1] and a few fixups here to make sure the directory tree for our built software doesn't have setgid files we shouldn't need to runAsUser: 0 any longer. [1] coreos/coreos-assembler#4410
Now that we are building via container tools `cosa fetch` isn't meaningful any longer.
dustymabe
force-pushed
the
dusty-uid-0
branch
from
c40b07f to
01dc47f
Compare
|
ok. at this point I say we merge this and deal with the |
|
@dustymabe and me had a chat, he has admin to merge I don't but this lgtm to do as this is very targeted. |
2 participants
With some changes made upstream to COSA [1] we shouldn't need to
runAsUser: 0 any longer.
[1] coreos/coreos-assembler#4410