Defining container users and privileges
You define your users and their privileges in the Docker containers using the default Helm chart deployed on Kubernetes. It provides guidance to ensure compatibility with the default non-root user setup, focusing on a minimal test environment as a starting point.
Default User Configuration
- Default User
- All HCL Commerce+ containers run as the non-root user
comuser(UID 1001) by default, as configured in the default Helm chart. - Purpose
- Enhances security by restricting container access to system-level resources in Kubernetes.
- Scope
- Applies to all HCL Commerce+ containers (
ts-app, store-web, nextjs-app, etc.) in the deployment.
Key considerations for HCL Commerce+ containers
- Custom code permissions
-
- Ensure that custom code files (for example, for
xc-app) are owned bycomuser(UID 1001) in the Helm deployment. - Use /home/comuser or /tmp for temporary files. Avoid root-owned paths like /root.
- Verify file permissions allow
comuserread/write access when mounting into containers.
- Ensure that custom code files (for example, for
- Utilities in the ts-utils container
-
- Set ownership of utility input/output files to
comuserin the default Helm values.yaml configuration file, or inside mounted volumes. Ensure mounted files (e.g., via Kubernetes volumes) have comuser permissions for seamless operation. - Confirm accessibility by
comuserto avoid permission errors during deployment. - Tools like dataload in
ts-utilsrequire configuration and data files owned bycomuser.
- Set ownership of utility input/output files to
- Building custom Docker images
-
- Use
comuseras the default user in custom images for HCL Commerce+. - For privileged tasks (such as installing tools), switch to
USER rootin the Dockerfile, then revert withUSER comuser. - Example:
COPY --chown=comuser:root ./custom-script /SETUP/bin/
- Use