Lower the priviliges of worker_wrapper Docker Container

[t-book]

What is the enhancement proposal? What problem are you trying to solve?

• worker_wrapper currently runs as root
• German BSI SYS.1.6 (SYS.1.6.A17 Ausführung von Containern ohne Privilegien) container security standard requires non-root execution or documented exceptions with privilege minimization

Description

Use Cases

• Organizations requiring BSI compliance

Technical Implementation

From what I see worker_wrapper must access the Docker daemon to spawn QGIS containers for job processing. This cannot be done without root or major architectural redesign. But BSI SYS.1.6.A17 allows exceptions for operational necessity if privileges are minimized which would be met with a minimal change in docker-compose.yml:

worker_wrapper:
  user: root
  cap_drop:
    - ALL     # Remove all Linux capabilities
  security_opt:
    - no-new-privileges:true  # Prevent privilege escalation attacks
  read_only: true             # Read-only root filesystem
  tmpfs:
    - /run:rw,noexec,nosuid,size=512m  # Temporary files (can't execute binaries)
  volumes:
    # ... existing mounts for /tmp, /app, etc.

All tests pass in my fork. But of course this needs to be tested carefully before used in production.
Find a nice overview regarding docker privilige settings here.

Agreements

• I commit to keeping my branch up to date with the latest master branch until my pull request is merged.
• I commit to writing tests for my enhancement proposal, if applicable.
• I am aware that my enhancement proposal and related pull request may not be accepted.

Additional context

No response

[lukasgraf]

First gut reaction: Yes, this would definitely be a great improvement that I would welcome!

I'll need a bit of time to read up on the references you provided (thanks!), and get into some of the details of the compose file options. But as far as I know and understand, the use of the docker socket to spawn docker-in-docker workers is indeed the only reason the worker wrapper currently needs to run as root. So the privilege dropping approach should work.

Thanks for the excellent issue, I'll get back to you on this as soon as I can!

[t-book]

Thanks for your nice feedback Lukas!