Summary
Update the CLP worker container image so that CLP binaries, including clp-s and indexer, are owned by clp-user instead of root.
Rationale
CLP package deployments run services as a non-root user. The affected binaries currently have mode 755, so they can run without a permission failure. Their root ownership is inconsistent with the CLP package convention.
Affected area
- CLP worker container image build configuration
- Installed CLP binaries such as
clp-s and indexer
Required changes
Ensure the image build installs or changes ownership of the CLP binaries to clp-user. Preserve the permissions required for non-root execution.
Acceptance criteria
clp-s is owned by clp-user in the CLP worker image.indexer is owned by clp-user in the CLP worker image.- CLP package services continue to run as a non-root user.
- The image retains executable permissions for the affected binaries.
Backlinks
Summary
Update the CLP worker container image so that CLP binaries, including
clp-sandindexer, are owned byclp-userinstead ofroot.Rationale
CLP package deployments run services as a non-root user. The affected binaries currently have mode
755, so they can run without a permission failure. Theirrootownership is inconsistent with the CLP package convention.Affected area
clp-sandindexerRequired changes
Ensure the image build installs or changes ownership of the CLP binaries to
clp-user. Preserve the permissions required for non-root execution.Acceptance criteria
clp-sis owned byclp-userin the CLP worker image.indexeris owned byclp-userin the CLP worker image.Backlinks