Update docker image to run as non-root

CHANGELOG.md

@@ -3,6 +3,11 @@
 * [ENHANCEMENT] Add querier metrics for requests executed [#3524](https://github.com/grafana/tempo/pull/3524) (@electron0zero)
 * [FEATURE] Added gRPC streaming endpoints for all tag queries. [#3460](https://github.com/grafana/tempo/pull/3460) (@joe-elliott)
 * [CHANGE] Align metrics query time ranges to the step parameter [#3490](https://github.com/grafana/tempo/pull/3490) (@mdisibio)
+* [CHANGE] Change the UID and GID of the `tempo` user to avoid root [#2265](https://github.com/grafana/tempo/pull/2265) (@zalegrala)
+  **BREAKING CHANGE** Ownership of /var/tempo is changing.  Specifically the
+  ingester and metrics-generator statefulsets may need to be `chown`'d in order
+  to come up properly.  A jsonnet example of an init container is included with
+  the PR.
 * [ENHANCEMENT] Add string interning to TraceQL queries [#3411](https://github.com/grafana/tempo/pull/3411) (@mapno)
 * [ENHANCEMENT] Add new (unsafe) query hints for metrics queries [#3396](https://github.com/grafana/tempo/pull/3396) (@mdisibio)
 * [ENHANCEMENT] Add nestedSetLeft/Right/Parent instrinsics to TraceQL. [#3497](https://github.com/grafana/tempo/pull/3497) (@joe-elliott)

cmd/tempo/Dockerfile

@@ -2,4 +2,13 @@ FROM alpine:3.19 as certs
 RUN apk --update add ca-certificates
 ARG TARGETARCH
 COPY bin/linux/tempo-${TARGETARCH} /tempo
+
+RUN addgroup -g 10001 -S tempo && \
+    adduser -u 10001 -S tempo -G tempo
+
+RUN mkdir -p /var/tempo && \
+    chown -R tempo:tempo /var/tempo
+
+USER 10001:10001
+
 ENTRYPOINT ["/tempo"]

integration/e2e/config-all-in-one-local.yaml

@@ -56,4 +56,4 @@ overrides:
     client:
       backend: local
       local:
-        path: /var/tempo_overrides
+        path: /var/tempo/overrides

integration/e2e/config-multi-tenant-local.yaml

@@ -69,4 +69,4 @@ overrides:
     client:
       backend: local
       local:
-        path: /var/tempo_overrides
+        path: /var/tempo/overrides

operations/jsonnet/microservices/common.libsonnet

@@ -1,4 +1,27 @@
 {
+
+  local k = import 'k.libsonnet',
+  local kausal = import 'ksonnet-util/kausal.libsonnet',
+
+  local container = k.core.v1.container,
+  local volumeMount = k.core.v1.volumeMount,
+  local statefulset = k.apps.v1.statefulSet,
+
+  tempo_chown_container(data_volume, uid)::
+    container.new('chown-' + data_volume, $._images.tempo) +
+    container.withCommand('chown') +
+    container.withArgs([
+      '-R',
+      uid,
+      '/var/tempo',
+    ]) +
+    container.withVolumeMounts([
+      volumeMount.new(data_volume, '/var/tempo'),
+    ]) +
+    container.securityContext.withRunAsUser(0) +
+    container.securityContext.withRunAsGroup(0) +
+    {},
+
   util+:: {
     local k = import 'ksonnet-util/kausal.libsonnet',
     local container = k.core.v1.container,
@@ -62,5 +85,17 @@
         },
       },
     },
+
+    withInitChown():: {
+      tempo_metrics_generator_statefulset+:
+        statefulset.spec.template.spec.withInitContainers([
+          self.tempo_metrics_generator_chown_container,
+        ]),
+
+      tempo_ingester_statefulset+:
+        statefulset.spec.template.spec.withInitContainers([
+          self.tempo_ingester_chown_container,
+        ]),
+    },
   },
 }

operations/jsonnet/microservices/generator.libsonnet

@@ -30,6 +30,8 @@
     + pvc.mixin.metadata.withLabels({ app: target_name })
     + pvc.mixin.metadata.withNamespace($._config.namespace),
 
+  tempo_metrics_generator_chown_container:: $.tempo_chown_container(tempo_data_volume, '10001'),
+
   tempo_metrics_generator_container::
     container.new(target_name, $._images.tempo) +
     container.withPorts($.tempo_metrics_generator_ports) +

operations/jsonnet/microservices/ingester.libsonnet

@@ -30,6 +30,9 @@
     + pvc.mixin.metadata.withLabels({ app: target_name })
     + pvc.mixin.metadata.withNamespace($._config.namespace),
 
+
+  tempo_ingester_chown_container:: $.tempo_chown_container(tempo_data_volume, '10001'),
+
   tempo_ingester_container::
     container.new(target_name, $._images.tempo) +
     container.withPorts($.tempo_ingester_ports) +
@@ -67,7 +70,8 @@
     statefulset.mixin.spec.withPodManagementPolicy('Parallel') +
     statefulset.mixin.spec.template.spec.withTerminationGracePeriodSeconds(1200) +
     $.util.podPriority('high') +
-    (if with_anti_affinity then $.util.antiAffinity else {}),
+    (if with_anti_affinity then $.util.antiAffinity else {})
+  ,
 
   tempo_ingester_statefulset: $.newIngesterStatefulSet(target_name, self.tempo_ingester_container) + statefulset.mixin.spec.withReplicas($._config.ingester.replicas),