fix: remove non-root user from the base library/ubuntu image

rocker-org · Nov 13, 2024 · e3a6b1d · e3a6b1d
1 parent 6416a0a
commit e3a6b1d
Show file tree

Hide file tree

Showing 40 changed files with 320 additions and 40 deletions.
diff --git a/build/templates/dockerfiles/cuda.Dockerfile.txt b/build/templates/dockerfiles/cuda.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/build/templates/dockerfiles/geospatial.Dockerfile.txt b/build/templates/dockerfiles/geospatial.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/build/templates/dockerfiles/ml-verse.Dockerfile.txt b/build/templates/dockerfiles/ml-verse.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/build/templates/dockerfiles/ml.Dockerfile.txt b/build/templates/dockerfiles/ml.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/build/templates/dockerfiles/r-ver.Dockerfile.txt b/build/templates/dockerfiles/r-ver.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/build/templates/dockerfiles/rstudio.Dockerfile.txt b/build/templates/dockerfiles/rstudio.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 ENV S6_VERSION="v2.1.0.2"
 ENV RSTUDIO_VERSION="{{rstudio_version}}"

diff --git a/build/templates/dockerfiles/shiny-verse.Dockerfile.txt b/build/templates/dockerfiles/shiny-verse.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/build/templates/dockerfiles/shiny.Dockerfile.txt b/build/templates/dockerfiles/shiny.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 ENV S6_VERSION="v2.1.0.2"
 ENV SHINY_SERVER_VERSION="latest"

diff --git a/build/templates/dockerfiles/tidyverse.Dockerfile.txt b/build/templates/dockerfiles/tidyverse.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/build/templates/dockerfiles/verse.Dockerfile.txt b/build/templates/dockerfiles/verse.Dockerfile.txt
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:{{ubuntu_series}}
 
 ENV R_VERSION="{{r_version}}"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/dockerfiles/cuda_4.4.1.Dockerfile b/dockerfiles/cuda_4.4.1.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="4.4.1"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/cuda_4.4.2.Dockerfile b/dockerfiles/cuda_4.4.2.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="4.4.2"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/cuda_devel.Dockerfile b/dockerfiles/cuda_devel.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="devel"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/geospatial_4.4.1.Dockerfile b/dockerfiles/geospatial_4.4.1.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:jammy
 
 ENV R_VERSION="4.4.1"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/dockerfiles/geospatial_4.4.2.Dockerfile b/dockerfiles/geospatial_4.4.2.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:noble
 
 ENV R_VERSION="4.4.2"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/dockerfiles/geospatial_devel.Dockerfile b/dockerfiles/geospatial_devel.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM docker.io/library/ubuntu:latest
 
 ENV R_VERSION="devel"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 COPY scripts/install_tidyverse.sh /rocker_scripts/install_tidyverse.sh
 RUN /rocker_scripts/install_tidyverse.sh

diff --git a/dockerfiles/ml-verse_4.4.1.Dockerfile b/dockerfiles/ml-verse_4.4.1.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="4.4.1"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/ml-verse_4.4.2.Dockerfile b/dockerfiles/ml-verse_4.4.2.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="4.4.2"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/ml-verse_devel.Dockerfile b/dockerfiles/ml-verse_devel.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="devel"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]
 

diff --git a/dockerfiles/ml_4.4.1.Dockerfile b/dockerfiles/ml_4.4.1.Dockerfile
@@ -1,3 +1,5 @@
+# syntax=docker/dockerfile:1
+
 FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04
 
 ENV R_VERSION="4.4.1"
@@ -12,7 +14,12 @@ ENV LANG=en_US.UTF-8
 
 COPY scripts/bin/ /rocker_scripts/bin/
 COPY scripts/setup_R.sh /rocker_scripts/setup_R.sh
-RUN /rocker_scripts/setup_R.sh
+RUN <<EOF
+if grep -q "1000" /etc/passwd; then
+    userdel --remove $(id -un "1000");
+fi
+/rocker_scripts/setup_R.sh
+EOF
 
 CMD ["R"]