Skip to content

fix(images): remove image-specific owner and mode set for gateway binary #1371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TaylorMutch merged 1 commit into from
May 13, 2026
+1 −7
Merged

fix(images): remove image-specific owner and mode set for gateway binary #1371

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions deploy/docker/Dockerfile.gateway
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,7 @@ ARG TARGETARCH

WORKDIR /app

# --chmod=0550 preserves the executable bit through actions/upload-artifact +
# download-artifact (which strip exec perms during the roundtrip) without
# granting world-execute. --chown=nvs:nvs matches the image's only defined
# non-root user (`nvs:1000`, the NVIDIA distroless convention) and aligns
# with the Helm chart's `securityContext.runAsUser: 1000`, which overrides
# the Dockerfile's USER at runtime.
COPY --chown=nvs:nvs --chmod=0550 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /usr/local/bin/openshell-gateway
COPY deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /usr/local/bin/openshell-gateway

USER nvs:nvs
EXPOSE 8080
Expand Down
Loading