From 18760810502c8e5578a6458d9a8f3680099c366b Mon Sep 17 00:00:00 2001
From: Paulo Gomes <paulo.gomes@weave.works>
Date: Tue, 18 Jan 2022 18:05:47 +0000
Subject: [PATCH] Enforce runAsNonRoot BREAKING CHANGE: the controller
 container is now executed under 65534:65534 (userid:groupid). This change may
 break deployments that hard-coded the user name 'controller' in their
 PodSecurityPolicy.

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>
---
 Dockerfile                     | 6 +-----
 config/manager/deployment.yaml | 1 +
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 46ada8702..4484efb50 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -90,10 +90,6 @@ FROM debian:bookworm-slim as controller
 # Link repo to the GitHub Container Registry image
 LABEL org.opencontainers.image.source="https://github.com/fluxcd/source-controller"
 
-# Configure user
-RUN addgroup --gid 65532 controller && \
-	useradd -u 65532 -s /sbin/nologin -g controller controller
-
 ARG TARGETPLATFORM
 RUN apt update && apt install -y ca-certificates
 
@@ -102,5 +98,5 @@ COPY --from=build /workspace/source-controller /usr/local/bin/
 COPY --from=libgit2-bullseye /libgit2/built-on-glibc-version /
 COPY ATTRIBUTIONS.md /
 
-USER controller
+USER 65534:65534
 ENTRYPOINT [ "source-controller" ]
diff --git a/config/manager/deployment.yaml b/config/manager/deployment.yaml
index debaf6de9..2a3fe0218 100644
--- a/config/manager/deployment.yaml
+++ b/config/manager/deployment.yaml
@@ -31,6 +31,7 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
+          runAsNonRoot: true
           capabilities:
             drop: [ "ALL" ]
           seccompProfile: