From 610f882efbe5173dd25af4cfab9b93fc76c4e3d6 Mon Sep 17 00:00:00 2001 From: Sarthak Bhardwaj Date: Sun, 12 Jul 2026 00:26:02 +0000 Subject: [PATCH] mcp: run image as numeric non-root user 14000 The mcp image created a non-root user but never set USER, so the container still ran as root. Set USER to the numeric UID 14000 and align the user with the root image's doc2vec:14000 account. A numeric USER lets kubelet enforce runAsNonRoot and lets downstream charts (such as kagent's querydoc subchart) drop their runAsUser pin. Signed-off-by: Sarthak Bhardwaj --- mcp/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/mcp/Dockerfile b/mcp/Dockerfile index 9a3cb41..011029d 100644 --- a/mcp/Dockerfile +++ b/mcp/Dockerfile @@ -86,8 +86,8 @@ COPY --from=builder /app/build /app/build COPY --from=builder /app/node_modules /app/node_modules # Create non-root user and verify build directory -RUN addgroup -g 1001 -S nodejs && \ - adduser -S kagent -u 1001 -G nodejs +RUN addgroup -g 14000 -S doc2vec && \ + adduser -S doc2vec -u 14000 -G doc2vec ADD https://doc-sqlite-db.s3.sa-east-1.amazonaws.com/kubernetes.db /app/build/kubernetes.db ADD https://doc-sqlite-db.s3.sa-east-1.amazonaws.com/istio.db /app/build/istio.db @@ -107,7 +107,7 @@ ADD https://doc-sqlite-db.s3.sa-east-1.amazonaws.com/ambient.db /app/build/ambie RUN for file in /app/build/*.db; do echo "Checksum for $file:";sha256sum "$file";done # Ensure the app directory is owned by the non-root user -RUN chown -R kagent:nodejs /app +RUN chown -R doc2vec:doc2vec /app LABEL org.opencontainers.image.source=https://github.com/kagent-dev/doc2vec LABEL org.opencontainers.image.description="Kagent Doc2Vec MCP" @@ -115,4 +115,7 @@ LABEL org.opencontainers.image.authors="Kagent Creators 🤖" EXPOSE 3001 +# Run as the numeric non-root UID so kubelet can enforce runAsNonRoot +USER 14000 + ENTRYPOINT ["node", "build/index.js"] \ No newline at end of file