Repository: runatlantis/atlantis (language: go)

Issue:
Run docker container as `atlantis` instead of `root`
<!--- Please keep this note for the community --->

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
* If you are interested in working on this issue or have submitted a pull request, please leave a comment.

<!--- Thank you for keeping this note for the community --->

---

<!---
When filing a bug, please include the following headings if possible.
Any example text in this template can be deleted.
--->

### Overview of the Issue

<!---
Please describe the issue you are having and how you encountered the problem.
--->
The default container runs as `root` instead of `atlantis`


### Reproduction Steps

<!--- 
In order to effectively and quickly resolve the issue, please provide exact steps that allow us the reproduce the problem. If no steps are provided, then it will likely take longer to get the issue resolved.
--->

```
✗ docker run -it --rm --entrypoint bash ghcr.io/runatlantis/atlantis:v0.25-alpine -c 'whoami'
root
```

### Logs

<!---
Provide log files from Atlantis server

logs can be retrieved from the deployment or from atlantis comments by adding `--debug` such as `atlantis plan --debug`

<details>
  <summary>Logs</summary>

```
log output
```

</details>
--->


### Environment details

<!---
If not already included, please provide the following:

- Atlantis version:
- Deployment method: ecs/eks/helm/tf module
- If not running the latest Atlantis version have you tried to reproduce this issue on the latest version: 
- Atlantis flags:

Atlantis server-side config file:

```yaml
# config file
```

Repo `atlantis.yaml` file:

```yaml
# config file
```

Any other information you can provide about the environment/deployment (efs/nfs, aws/gcp, k8s/fargate, etc)
--->


### Additional Context

<!---
Additional context on the problem. Docs, links to blogs, or other material that lead you to discover this issue or were helpful in troubleshooting the issue. 

Use a bulleted list to link to tickets
--->

The fix would be to add `USER atlantis` at the bottom before the entrypoint. This may require additional changes such as chmod/chown access to the other directories that atlantis commonly accesses or even migrating to a better home specific directory structure.

This will most likely require changes to the [docker-entrypoint.sh](https://github.com/runatlantis/atlantis/blob/main/docker-entrypoint.sh) and subsequent removal of vulnerable [`gosu`](https://github.com/tianon/gosu) (see issues).
Fix dockle container security issues
<!--- Please keep this note for the community --->

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
* If you are interested in working on this issue or have submitted a pull request, please leave a comment.

<!--- Thank you for keeping this note for the community --->

---

<!---
When filing a bug, please include the following headings if possible.
Any example text in this template can be deleted.
--->

### Overview of the Issue

<!---
Please describe the issue you are having and how you encountered the problem.
--->

Fix dockle container security issues


### Reproduction Steps

<!--- 
In order to effectively and quickly resolve the issue, please provide exact steps that allow us the reproduce the problem. If no steps are provided, then it will likely take longer to get the issue resolved.
--->

alpine

```
✗ dockle ghcr.io/runatlantis/atlantis:v0.25.0-alpine
WARN	- CIS-DI-0001: Create a user for the container
	* Last user should not be root
INFO	- CIS-DI-0005: Enable Content trust for Docker
	* export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO	- CIS-DI-0006: Add HEALTHCHECK instruction to the container image
	* not found HEALTHCHECK statement
```

debian

```
✗ dockle ghcr.io/runatlantis/atlantis:v0.25.0-debian
WARN	- CIS-DI-0001: Create a user for the container
	* Last user should not be root
INFO	- CIS-DI-0005: Enable Content trust for Docker
	* export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO	- CIS-DI-0006: Add HEALTHCHECK instruction to the container image
	* not found HEALTHCHECK statement
INFO	- CIS-DI-0008: Confirm safety of setuid/setgid files
	* setgid file: grwxr-xr-x usr/bin/expiry
	* setuid file: urwxr-xr-x usr/bin/chfn
	* setuid file: urwxr-xr-x usr/bin/umount
	* setgid file: grwxr-xr-x usr/bin/ssh-agent
	* setgid file: grwxr-xr-x usr/bin/wall
	* setuid file: urwxr-xr-x usr/lib/openssh/ssh-keysign
	* setuid file: urwxr-xr-x usr/bin/passwd
	* setuid file: urwxr-xr-x usr/bin/su
	* setuid file: urwxr-xr-x usr/bin/mount
	* setuid file: urwxr-xr-x usr/bin/newgrp
	* setgid file: grwxr-xr-x usr/bin/chage
	* setuid file: urwxr-xr-x usr/bin/gpasswd
	* setuid file: urwxr-xr-x usr/bin/chsh
	* setgid file: grwxr-xr-x usr/sbin/unix_chkpwd
```

### Additional Context

<!---
Additional context on the problem. Docs, links to blogs, or other material that lead you to discover this issue or were helpful in troubleshooting the issue. 

Use a bulleted list to link to tickets
--->

- https://github.com/goodwithtech/dockle
- Related to https://github.com/runatlantis/atlantis/issues/3777


Discussion / hints:
Did this change at some point? I think the `0.23.x` containers had atlantis as the primary user


Fix patch:
diff --git a/Dockerfile b/Dockerfile
index e87dcbc32b..4e24da51bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,7 +41,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 FROM debian:${DEBIAN_TAG} as debian-base
 
-# Install packages needed for running Atlantis.
+# Install packages needed to run Atlantis.
 # We place this last as it will bust less docker layer caches when packages update
 # hadolint ignore explanation
 # DL3008 (pin versions using "=") - Ignored to avoid failing the build
@@ -89,30 +89,6 @@ RUN AVAILABLE_CONFTEST_VERSIONS=${DEFAULT_CONFTEST_VERSION} && \
         rm checksums.txt; \
     done
 
-# install gosu
-# We use gosu to step down from root and run as the atlantis user
-# renovate: datasource=github-releases depName=tianon/gosu
-ENV GOSU_VERSION=1.16
-
-RUN case ${TARGETPLATFORM} in \
-        "linux/amd64") GOSU_ARCH=amd64 ;; \
-        "linux/arm64") GOSU_ARCH=arm64 ;; \
-        "linux/arm/v7") GOSU_ARCH=armhf ;; \
-    esac && \
-    curl -L -s --output gosu "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}" && \
-    curl -L -s --output gosu.asc "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${GOSU_ARCH}.asc" && \
-    for server in $(shuf -e ipv4.pool.sks-keyservers.net \
-                            hkp://p80.pool.sks-keyservers.net:80 \
-                            keyserver.ubuntu.com \
-                            hkp://keyserver.ubuntu.com:80 \
-                            pgp.mit.edu) ; do \
-        gpg --keyserver "$server" --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && break || : ; \
-    done && \
-    gpg --batch --verify gosu.asc gosu && \
-    chmod +x gosu && \
-    cp gosu /bin && \
-    gosu --version
-
 # install git-lfs
 # renovate: datasource=github-releases depName=git-lfs/git-lfs
 ENV GIT_LFS_VERSION=3.4.0
@@ -159,26 +135,27 @@ RUN AVAILABLE_TERRAFORM_VERSIONS="1.3.10 1.4.6 1.5.7 ${DEFAULT_TERRAFORM_VERSION
 # Creating the individual distro builds using targets
 FROM alpine:${ALPINE_TAG} AS alpine
 
-# atlantis user for gosu and OpenShift compatibility
+EXPOSE ${ATLANTIS_PORT:-4141}
+
+HEALTHCHECK --interval=5m --timeout=3s \
+  CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1
+
+# Set up the 'atlantis' user and adjust permissions
 RUN addgroup atlantis && \
     adduser -S -G atlantis atlantis && \
-    adduser atlantis root && \
     chown atlantis:root /home/atlantis/ && \
-    chmod g=u /home/atlantis/ && \
-    chmod g=u /etc/passwd
+    chmod u+rwx /home/atlantis/
 
-# copy binary
+# copy atlantis binary
 COPY --from=builder /app/atlantis /usr/local/bin/atlantis
-# copy terraform
+# copy terraform binaries
 COPY --from=deps /usr/local/bin/terraform* /usr/local/bin/
-# copy deps
+# copy dependencies
 COPY --from=deps /usr/local/bin/conftest /usr/local/bin/conftest
-COPY --from=deps /bin/gosu /bin/gosu
 COPY --from=deps /usr/bin/git-lfs /usr/bin/git-lfs
-# copy docker entrypoint
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-# Install packages needed for running Atlantis.
+# Install packages needed to run Atlantis.
 # We place this last as it will bust less docker layer caches when packages update
 RUN apk add --no-cache \
         ca-certificates~=20230506 \
@@ -191,29 +168,36 @@ RUN apk add --no-cache \
         dumb-init~=1.2 \
         gcompat~=1.1
 
+
+# Set the entry point to the atlantis user and run the atlantis command
+USER atlantis
 ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["server"]
 
 # Stage 2 - Debian
 FROM debian-base AS debian
 
-# Add atlantis user to Debian as well
+EXPOSE ${ATLANTIS_PORT:-4141}
+
+HEALTHCHECK --interval=5m --timeout=3s \
+  CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1
+
+# Set up the 'atlantis' user and adjust permissions
 RUN useradd --create-home --user-group --shell /bin/bash atlantis && \
-    adduser atlantis root && \
     chown atlantis:root /home/atlantis/ && \
-    chmod g=u /home/atlantis/ && \
-    chmod g=u /etc/passwd
+    chmod u+rwx /home/atlantis/
 
-# copy binary
+# copy atlantis binary
 COPY --from=builder /app/atlantis /usr/local/bin/atlantis
-# copy terraform
+# copy terraform binaries
 COPY --from=deps /usr/local/bin/terraform* /usr/local/bin/
-# copy deps
+# copy dependencies
 COPY --from=deps /usr/local/bin/conftest /usr/local/bin/conftest
-COPY --from=deps /bin/gosu /bin/gosu
 COPY --from=deps /usr/bin/git-lfs /usr/bin/git-lfs
-# copy docker entrypoint
+# copy docker-entrypoint.sh
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
+# Set the entry point to the atlantis user and run the atlantis command
+USER atlantis
 ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["server"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index dd4e15e7bf..bdb00e4cf8 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -29,18 +29,4 @@ if ! whoami > /dev/null 2>&1; then
   fi
 fi
 
-# If we're running as root and we're trying to execute atlantis then we use
-# gosu to step down from root and run as the atlantis user.
-# In OpenShift, containers are run as a random users so we don't need to use gosu.
-if [ "$(id -u)" = 0 ] && [ "$1" = 'atlantis' ]; then
-    # If requested, set the capability to bind to privileged ports before
-    # we drop to the non-root user. Note that this doesn't work with all
-    # storage drivers (it won't work with AUFS).
-    if [ -n "${ATLANTIS_ALLOW_PRIVILEGED_PORTS+x}" ]; then
-        setcap "cap_net_bind_service=+ep" /bin/atlantis
-    fi
-
-    set -- gosu atlantis "$@"
-fi
-
 exec "$@"


Test patch: