fix(security): pin base image digest and run as jenkins user - #5173
Open
causten wants to merge 1 commit into
Open
fix(security): pin base image digest and run as jenkins user#5173causten wants to merge 1 commit into
causten wants to merge 1 commit into
Conversation
Addresses ROCM-26612, ROCM-26613. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the project’s Docker build environment by making the base image reproducible (digest-pinned) and switching the container’s default runtime user away from root.
Changes:
- Pin
ubuntu:24.04to a specificsha256digest for supply-chain/reproducibility. - Add a non-root
jenkinsuser and switch the image defaultUSERtojenkins.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+159
to
+160
| RUN groupadd -r jenkins && useradd -r -g jenkins -m jenkins && \ | ||
| chown -R jenkins:jenkins /tmp /var/tmp $ONNX_HOME |
Comment on lines
+159
to
+160
| RUN groupadd -r jenkins && useradd -r -g jenkins -m jenkins && \ | ||
| chown -R jenkins:jenkins /tmp /var/tmp $ONNX_HOME |
Comment on lines
+162
to
+163
| USER jenkins | ||
|
|
Regressions detected 🔴 * No develop baseline was found for this PR's branch point; compared against the latest available develop run instead. |
|
pfultz2
requested changes
Aug 23, 2026
| ENV ASAN_OPTIONS=detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1 | ||
| RUN ln -s /opt/rocm/llvm/bin/llvm-symbolizer /usr/bin/llvm-symbolizer | ||
|
|
||
| RUN groupadd -r jenkins && useradd -r -g jenkins -m jenkins && \ |
Collaborator
There was a problem hiding this comment.
Dont add a jenkins user as this might not match the user id of the jenkins user on the machine.
Comment on lines
+159
to
+162
| RUN groupadd -r jenkins && useradd -r -g jenkins -m jenkins && \ | ||
| chown -R jenkins:jenkins /tmp /var/tmp $ONNX_HOME | ||
|
|
||
| USER jenkins |
Collaborator
There was a problem hiding this comment.
This should just be deleted as this is not a security issue. Jenkins user should be set when running the docker container(which is already the case).
Suggested change
| RUN groupadd -r jenkins && useradd -r -g jenkins -m jenkins && \ | |
| chown -R jenkins:jenkins /tmp /var/tmp $ONNX_HOME | |
| USER jenkins |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
JIRA
Test plan
Made with Cursor