User Dockerfile Azure Function

Question

Guys, someone already configured dockerfile without using root user with the image "mcr.microsoft.com/azure-functions/dotnet:4-appservice".

It seems that we should give system authorization to such a user, but it doesn't make sense in terms of security to take such a strategy.

To run the function, you need write to ect/profile plus permission to run sshd.

Answer 1

Hello, @Bruno Moura de Jesus - Thanks for reaching out! Could you clarify & elaborate on your exact question? Are you saying only those with elevated permissions should be able to do docker pull .. in your system?

Docker provides guidance on Roles & permissions, and covers who can be allowed for Pulling images: https://docs.docker.com/docker-hub/roles-and-permissions/#content-and-registry-permissions

On the Azure side, you should always have RBAC and policies on the tenant level. For containers specifically, the guidance will vary depending on which Container-related service you might be using. For example, with Azure Container Registry, the following doc covers which role should be permitted to Pull an image: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli