Skip to content

fix(docker): run container as non-root user #516

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vincent067 wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(docker): run container as non-root user #516

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1211c15
docs: add Quick Start Guide section to README
Apr 17, 2026
a5ef569
docs: add Quick Start Guide section to README
Apr 17, 2026
c7fc112
fix(docker): run container as non-root user for security
Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Use the official Python 3.12 slim image as the base image
FROM python:3.12-slim AS builder
ENV LANG=C.UTF-8
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONDONTWRYTEBYTECODE=1
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Official Python documentation PYTHONDONTWRITEBYTECODE environment variable

💡 Result:

The official Python documentation for the PYTHONDONTWRITEBYTECODE environment variable is found in the "Command line and environment" section of the Python documentation (e.g., for Python 3.14 at https://docs.python.org/3/using/cmdline.html). It states: If this is set to a non-empty string, Python won't try to write .pyc files on the import of source modules. This is equivalent to specifying the -B option. Note: As of late 2025, there is an open issue (python/cpython#143134) claiming the documentation is incorrect because the variable is parsed as a flag using _Py_get_env_flag, which treats any non-empty value (including non-numeric strings or "0") as true (1), enabling the no-write-bytecode behavior. Numeric "0" is false. A PR to update the docs is linked but status unclear as of 2026-04-18. Usage examples from sources confirm setting it to 1 or any non-empty value disables .pyc generation.

Citations:

Fix the Python bytecode environment variable typo.

PYTHONDONTWRYTEBYTECODE is not recognized by Python due to the misspelling ("WRYTE" instead of "WRITE"), so bytecode suppression will not be applied. The correct variable name is PYTHONDONTWRITEBYTECODE.

🐛 Proposed fix 
-ENV PYTHONDONTWRYTEBYTECODE=1
+ENV PYTHONDONTWRITEBYTECODE=1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ENV PYTHONDONTWRYTEBYTECODE=1
ENV PYTHONDONTWRITEBYTECODE=1
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile` at line 4, The Dockerfile contains a misspelled environment
variable ENV PYTHONDONTWRYTEBYTECODE=1 which prevents Python from suppressing
.pyc generation; change the ENV entry to use the correct variable name
PYTHONDONTWRITEBYTECODE with the same value (i.e., replace
PYTHONDONTWRYTEBYTECODE with PYTHONDONTWRITEBYTECODE) so Python recognizes and
applies the bytecode suppression.

ENV PYTHONUNBUFFERED=1
ENV PATH="/app/venv/bin:$PATH"

Expand All @@ -24,5 +24,12 @@ COPY ./krr.py krr.py
COPY ./robusta_krr/ robusta_krr/
COPY ./intro.txt intro.txt

# Create a non-root user for security
RUN adduser --disabled-password --gecos "" --uid 1000 krr && \
chown -R krr:krr /app

# Switch to non-root user
USER 1000

# Run the application using 'poetry run krr simple'
CMD ["python", "krr.py", "simple"]
45 changes: 45 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,51 @@ By right-sizing your containers with KRR, you can save an average of 69% on clou

Read more about [how KRR works](#how-krr-works)

<!-- QUICK START -->

## Quick Start Guide

Get up and running with KRR in under 5 minutes:

### 1. Install KRR

```bash
pip install robusta-krr
```

### 2. Verify Installation

```bash
krr --help
```

### 3. Run Your First Scan

```bash
krr simple --prometheus-url=http://localhost:9090
```

That's it! You now have recommendations for optimizing your Kubernetes resources.

For more details, see the full [Installation](#installation) and [Usage](#usage) sections below.


## Quick Start Guide

Get started with KRR in under 5 minutes:

```bash
# Install with Homebrew
brew tap robusta-dev/homebrew-krr
brew install krr

# Verify installation
krr version

# Run your first scan
krr simple
```
Comment on lines +106 to +149
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Consolidate the duplicate Quick Start sections.

Line 135 duplicates the ## Quick Start Guide heading and triggers MD024. The two sections also give different first-scan commands; prefer one quick start with pip/Homebrew install options and use krr simple unless the user has explicitly port-forwarded Prometheus.

📝 Proposed docs cleanup 
 <!-- QUICK START -->
 
 ## Quick Start Guide
 
 Get up and running with KRR in under 5 minutes:
 
-### 1. Install KRR
+### Option A: Install with pip
 
 ```bash
 pip install robusta-krr

-### 2. Verify Installation
+### Option B: Install with Homebrew

-krr --help
+brew tap robusta-dev/homebrew-krr
+brew install krr

-### 3. Run Your First Scan
+### Verify installation

-krr simple --prometheus-url=http://localhost:9090
+krr --help

-That's it! You now have recommendations for optimizing your Kubernetes resources.

-For more details, see the full Installation and Usage sections below.

-## Quick Start Guide

-Get started with KRR in under 5 minutes:
+### Run your first scan

-# Install with Homebrew
-brew tap robusta-dev/homebrew-krr
-brew install krr
-
-# Verify installation
-krr version
-
-# Run your first scan
krr simple

+If Prometheus is not auto-discovered, see Giving an Explicit Prometheus URL.
+
+That's it! You now have recommendations for optimizing your Kubernetes resources.
+
+For more details, see the full Installation and Usage sections below.


</details>

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.22.0)</summary>

[warning] 135-135: Multiple headings with the same content

(MD024, no-duplicate-heading)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @README.md around lines 106 - 149, Remove the duplicate "## Quick Start
Guide" block and merge both installs into one concise section that presents pip
and Homebrew as Option A/Option B (keep "pip install robusta-krr" and "brew tap
robusta-dev/homebrew-krr" / "brew install krr"), use a single verify step (e.g.,
"krr --help" or "krr version") and a single first-scan command "krr simple"
(with a sentence noting to use "--prometheus-url" only if Prometheus is not
auto-discovered); update or remove the extra lines suggested in the diff so the
file contains one Quick Start section that references the existing Installation
and Usage anchors.


</details>

<!-- fingerprinting:phantom:poseidon:ibis -->

<!-- This is an auto-generated comment by CodeRabbit -->


## Difference with Kubernetes VPA

| Feature 🛠️ | Robusta KRR 🚀 | Kubernetes VPA 🌐 |
Expand Down