loft-sh / jspolicy

jsPolicy - Easier & Faster Kubernetes Policies using JavaScript or TypeScript

Home Page:https://www.jspolicy.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

reduce docker image size and use non-root user

infa-ddeore opened this issue · comments

loftsh/jspolicy image is around 1.2G, also the jspolicy process runs as root user which would flag security concerns

  1. can the image size be reduced
  2. i think root user is used to listen on 80 and 443 port but this can be higher ports (>1024) and expose them on 80/443 via k8s service so root user isnt required

@infa-ddeore thanks for creating this issue! Regarding your points:

  1. We need to check if we can use the node alpine image which should be significantly smaller. However we need to package the v8 engine which is quite large, but we should definitely be able to reduce image size
  2. We'll investigate this and see if we can make jspolicy run as non root by default

@infa-ddeore we decreased image size by a significant margin as well as default jsPolicy running as non root in v0.2.0-beta.3