Twistlock Scan Finding "Image should be created with a non-root user" #5586

Activity

1. friedrichg

   added

   type/feature

   type/security

   on Oct 6, 2023
2. sandy2008 commented on Oct 28, 2026

   

   sandy2008

   on Oct 28, 2026

   Contributor

   More actions

   For reference, this is still the case after the switch to a distroless base in #7637 (in the 1.22.0 release candidates): the image deliberately keeps running as root because Cortex's default -server.http-listen-port is 80, a privileged port, as explained in the #7637 description. The base image is now an overridable BASEIMG build arg (

   cortex/cmd/cortex/Dockerfile

   Lines 1 to 8 in 5d93557

   	ARG BASEIMG=gcr.io/distroless/static-debian12:latest
   	FROM ${BASEIMG}
   	ARG TARGETARCH
   	COPY migrations /migrations/
   	COPY cortex-$TARGETARCH /bin/cortex
   	EXPOSE 80
   	ENTRYPOINT [ "/bin/cortex" ]

   ), so a non-root image can be built on gcr.io/distroless/static-debian12:nonroot if it's paired with a non-privileged listen port and data directories writable by that user, but publishing non-root images would mean changing that default or shipping a separate variant.