Unable to run the universalforwarder Splunk image in OpenShift with no root

[JTG2020]

HI,

We want to use image https://hub.docker.com/r/splunk/universalforwarder image in OpenShift however we found that the image have to be run with root user.
We looked at various options such changing Ansible playbooks but we are not successful.
Could you please let us know if running this image with nonroot user is even possible ?

Thanks

[wzhiana]

we created our own image for that reason.
and we see lots of benefits:

• faster boot
• smaller size
• less vulnerable packages
• we control how it is being started and which user

[JTG2020]

Can you share the Dockerfile if you dont mind ?

[wzhiana]

yes, but it will not help you a lot:

FROM url_to/docker/redhat/ubi9:latest

COPY ubi.repo /etc/yum.repos.d/

RUN dnf install -y procps \
  && useradd splunk \
  && ARCH=$(uname -m) \
  && rpm -i "https://url_to_splunk/splunkforwarder-linux.${ARCH}.rpm" \
  && dnf clean dbcache

COPY configure.sh /

ENTRYPOINT ["bash", "/configure.sh"]

and congigure.sh just sh script which creates some basic conf files and starts splunk,

[lucalopreiato]

hello, there is still no official way to make Splunk UF run on Openshift?