Change UID user on build stage

2026-05-13 21:23:26 +07:00
parent 6b9e2fbfb3
commit a70b0bd492
5 changed files with 76 additions and 12 deletions
@@ -14,8 +14,21 @@ ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
 ARG TARGETARCH
 ARG wazuh_agent_x86_64_rpm
 ARG wazuh_agent_aarch64_rpm
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101

-RUN RPM_ARCH="x86_64" && \
+# Install only runtime dependencies
+RUN dnf install procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
+    getent passwd wazuh || useradd --system \
+        --no-create-home \
+        --home-dir /var/ossec \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh && \
+    RPM_ARCH="x86_64" && \
    if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
    URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \
    agent_url="${!URL_VAR}" && \
@@ -56,10 +69,10 @@ RUN dnf install procps shadow-utils -y && \
        wazuh

 # Copy Wazuh Agent installation from builder
-COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /var/ossec /var/ossec
+COPY --from=builder /var/ossec /var/ossec

 # Copy tini static binary
-COPY --from=builder  --chown=${WAZUH_UID}:${WAZUH_GID} /usr/local/bin/tini /usr/local/bin/tini
+COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini

 # Copy entrypoint and init scripts
 COPY config/entrypoint.sh /entrypoint.sh
@@ -7,9 +7,28 @@ ARG TARGETARCH
 ARG wazuh_dashboard_x86_64_rpm
 ARG wazuh_dashboard_aarch64_rpm
 ARG wazuh_config_yml
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+# Set environment variables
+ENV USER="wazuh-dashboard" \
+    GROUP="wazuh-dashboard" \
+    NAME="wazuh-dashboard" \
+    INSTALL_DIR="/usr/share/wazuh-dashboard" 

 # Update and install dependencies
-RUN RPM_ARCH="x86_64" && \
+RUN yum install shadow-utils -y && \
+    yum clean all && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
+    useradd --system \
+    --uid ${WAZUH_UID} \
+    --no-create-home \
+    --home-dir $INSTALL_DIR \
+    --gid $GROUP \
+    --shell /sbin/nologin \
+    --comment "$USER user" \
+    $USER && \
+    RPM_ARCH="x86_64" && \
    if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
    URL_VAR="wazuh_dashboard_${RPM_ARCH}_rpm" && \
    dashboard_url="${!URL_VAR}" && \
@@ -80,8 +99,8 @@ RUN yum install shadow-utils -y && \
    mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom

 # Copy Install dir from builder to current image
-COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR $INSTALL_DIR
-COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /etc/wazuh-dashboard $INSTALL_DIR/config/
+COPY --from=builder $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder /etc/wazuh-dashboard $INSTALL_DIR/config/

 # Set workdir and user
 WORKDIR $INSTALL_DIR
@@ -7,10 +7,28 @@ ARG wazuh_indexer_x86_64_rpm
 ARG wazuh_indexer_aarch64_rpm
 ARG wazuh_certs_tool
 ARG wazuh_config_yml
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101
+
+ENV USER="wazuh-indexer" \
+    GROUP="wazuh-indexer" \
+    NAME="wazuh-indexer" \
+    INSTALL_DIR="/usr/share/wazuh-indexer" 

 COPY config/config.sh .

-RUN RPM_ARCH="x86_64" && \
+RUN yum install curl-minimal shadow-utils findutils hostname -y && \
+    yum clean all && \
+    getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
+    useradd --system \
+            --uid ${WAZUH_UID} \
+            --no-create-home \
+            --home-dir $INSTALL_DIR \
+            --gid ${WAZUH_GID} \
+            --shell /sbin/nologin \
+            --comment "$USER user" \
+            $USER && \
+    RPM_ARCH="x86_64" && \
    if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
    URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \
    indexer_url="${!URL_VAR}" && \
@@ -62,7 +80,7 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \
    mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
    mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer

-COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR $INSTALL_DIR
+COPY --from=builder $INSTALL_DIR $INSTALL_DIR

 RUN chmod 700 $INSTALL_DIR && \
    chmod 700 $INSTALL_DIR/config && \
@@ -13,7 +13,9 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
 # Modify opensearch.yml config paths
 if [ -d "/etc/wazuh-indexer" ]; then
    mkdir -p ${CONFIG_DIR}
+    chown ${USER}:${GROUP} ${CONFIG_DIR}
    mkdir -p ${CONFIG_DIR}/certs
+    chown ${USER}:${GROUP} ${CONFIG_DIR}/certs
    mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
    rmdir /etc/wazuh-indexer
 fi
@@ -12,15 +12,27 @@ ARG TINI_VERSION="v0.19.0"
 ARG TARGETARCH
 ARG wazuh_manager_x86_64_rpm
 ARG wazuh_manager_aarch64_rpm
+ARG WAZUH_UID=101
+ARG WAZUH_GID=101

 # Prepare permanent data config needed by permanent_data.sh at build time
 COPY config/permanent_data.env config/permanent_data.sh /

-RUN RPM_ARCH="x86_64" && \
+RUN dnf install openssl findutils procps shadow-utils -y && \
+    dnf clean all && \
+    getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
+    getent passwd wazuh-manager || useradd --system \
+        --no-create-home \
+        --home-dir /var/wazuh-manager \
+        --uid ${WAZUH_UID} \
+        --gid ${WAZUH_GID} \
+        --shell /sbin/nologin \
+        wazuh-manager && \
+    RPM_ARCH="x86_64" && \
    if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
    URL_VAR="wazuh_manager_${RPM_ARCH}_rpm" && \
    manager_url="${!URL_VAR}" && \
-    dnf install curl-minimal xz gnupg tar gzip openssl findutils procps shadow-utils -y && \
+    dnf install curl-minimal xz gnupg tar gzip -y && \
    dnf clean all && \
    curl -o /wazuh-manager.rpm "${manager_url}" && \
    dnf install /wazuh-manager.rpm -y && \
@@ -71,10 +83,10 @@ RUN dnf install openssl findutils procps shadow-utils -y && \
        wazuh-manager

 # Copy Wazuh Manager installation (includes permanent data snapshot)
-COPY --from=builder  --chown=${WAZUH_UID}:${WAZUH_GID} /var/wazuh-manager /var/wazuh-manager
+COPY --from=builder /var/wazuh-manager /var/wazuh-manager

 # Copy tini static binary
-COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /usr/local/bin/tini /usr/local/bin/tini
+COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini

 # Copy entrypoint, init scripts and runtime config
 COPY config/entrypoint.sh /entrypoint.sh