Defining container users and privileges

You define your users and their privileges in the Docker containers using the default Helm chart deployed on Kubernetes. It provides guidance to ensure compatibility with the default non-root user setup, focusing on a minimal test environment as a starting point.

Default User Configuration

Default User
All HCL Commerce+ containers run as the non-root user comuser (UID 1001) by default, as configured in the default Helm chart.
Purpose
Enhances security by restricting container access to system-level resources in Kubernetes.
Scope
Applies to all HCL Commerce+ containers (ts-app, store-web, nextjs-app, etc.) in the deployment.

Key considerations for HCL Commerce+ containers

Custom code permissions
  • Ensure that custom code files (for example, for xc-app) are owned by comuser (UID 1001) in the Helm deployment.
  • Use /home/comuser or /tmp for temporary files. Avoid root-owned paths like /root.
  • Verify file permissions allow comuser read/write access when mounting into containers.
Utilities in the ts-utils container
  • Set ownership of utility input/output files to comuser in the default Helm values.yaml configuration file, or inside mounted volumes. Ensure mounted files (e.g., via Kubernetes volumes) have comuser permissions for seamless operation.
  • Confirm accessibility by comuser to avoid permission errors during deployment.
  • Tools like dataload in ts-utils require configuration and data files owned by comuser.
Building custom Docker images
  • Use comuser as the default user in custom images for HCL Commerce+.
  • For privileged tasks (such as installing tools), switch to USER root in the Dockerfile, then revert with USER comuser.
  • Example: COPY --chown=comuser:root ./custom-script /SETUP/bin/