feat: run workload and charm as unprivileged user #522
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
Libraries: Out of sync
dariofaccin
force-pushed
the
KF-8210-unprivileged-charm
branch
from
f52280b to
02ffd44
Compare
Signed-off-by: Dario Faccin <[email protected]>
Signed-off-by: Dario Faccin <[email protected]>
Signed-off-by: Dario Faccin <[email protected]>
Signed-off-by: Dario Faccin <[email protected]>
Signed-off-by: Dario Faccin <[email protected]>
dariofaccin
force-pushed
the
KF-8210-unprivileged-charm
branch
from
619eef6 to
aaaede0
Compare
MattiaSarti
approved these changes
Dec 3, 2025
Contributor
MattiaSarti
left a comment
MattiaSarti
left a comment
There was a problem hiding this comment.
note: as for most charms, there are no other workloads in addition to the charms' ones, already configured via metadata.yaml
Signed-off-by: Dario Faccin <[email protected]>
Signed-off-by: Dario Faccin <[email protected]>
dariofaccin
force-pushed
the
KF-8210-unprivileged-charm
branch
from
d83ff05 to
7450582
Compare
Signed-off-by: Dario Faccin <[email protected]>
kimwnasptd
approved these changes
Dec 5, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces rootless platform-component workload and charms.
The workload container is run with user ID
584792(which in the rock OCI image is mapped to user_daemon_).The charm container is run with user
juju, with static ID170.The PR includes integration tests to assert that the security context of each container in the pod is correct.
Storage mounts in charm
This PR adds two new storages, named
configandlogos, in the charm metadata; these storages are then mounted in the workload container under the/etc/configand/src/apps/default/static/assets/logos/paths (respectively).This addition is necessary since the workload is required to write config files and logos on the filesystem, and
pebbleis not running asrootanymore, causing the operation to fail otherwise.This change allows to remove hardcoded config and logos paths in the charm code.
This PR closes #520.