Adding a non-root user

You can add a non-root user to the Sterling B2B Integrator Certified Container image.

1. Copy the contents shown below to a file named as Dockerfile and place it on a host that has Docker client installed.

   
   FROM b2bi:latest AS b2bi-base
   
   FROM registry.access.redhat.com/ubi7/ubi:7.9 AS b2bi-extended
   
   ARG USER_NAME=b2biuser
   ARG USER_ID
   ARG GROUP_NAME=b2bigroup
   ARG GROUP_ID
   
   LABEL name="IBM Sterling B2B Integrator Enterprise Edition Certified Container" \
         vendor="IBM" \
         version="6.1.0" \
         release="6.1.0" \
         summary="Sterling File Gateway lets organizations transfer files between partners using different protocols, conventions for naming files, and file formats. A scalable and security-enabled gateway, Sterling File Gateway enables companies to consolidate all their internet-based file transfers on a single edge gateway, which helps secure your B2B collaboration network and the data flowing through it. To find out more, see IBM Sterling File Gatewayon IBM Marketplace." \
         description="IBM Sterling B2B Integrator Enterprise Edition Certified Container"
   	  
   #LABEL name="IBM Sterling File Gateway Enterprise Edition Certified Container" \
   #      vendor="IBM" \
   #      version="6.1.0" \
   #      release="6.1.0" \
   #      summary="Sterling B2B Integrator helps companies integrate complex B2B EDI processes with their partner communities. Organizations get a single, flexible B2B platform that supports most communication protocols, helps secure your B2B network and data, and achieves high-availability operations. The offering enables companies to reduce costs by consolidating EDI and non-EDI any-to-any transmissions on a single B2B platform and helps automate B2B processes across enterprises, while providing governance and visibility over those processes. To find out more, see IBM Sterling B2B Integrator on IBM Marketplace." \
   #      description="IBM Sterling File Gateway Enterprise Edition Certified Container"	  
   
   USER root
        
   RUN yum install --disableplugin=subscription-manager  -y  libprocps4 procps gpgv systemd \
       && yum install --disableplugin=subscription-manager  -y bash lsb-release \
       && yum install --disableplugin=subscription-manager  -y unzip \
       && yum install --disableplugin=subscription-manager  -y xz \
       && yum install --disableplugin=subscription-manager -y tzdata \
       && yum install --disableplugin=subscription-manager  -y openssl \
   	&& yum --disableplugin=subscription-manager clean all \
       && yum --disableplugin=subscription-manager -y autoremove \
       && localedef -i en_US -f UTF-8 en_US.UTF-8  \
       && groupadd -g ${GROUP_ID} ${GROUP_NAME} \
       && adduser -l -r -u ${USER_ID} -m -d /home/${USER_NAME} -s /sbin/nologin -c "B2BI user" -g ${GROUP_NAME} ${USER_NAME} \
       && chmod 755 /home/${USER_NAME} \
       && sed -i "s/^hosts:.*/hosts:      files dns/g" /etc/nsswitch.conf \
       && update-alternatives --install /bin/sh sh /bin/bash 100
   
   COPY --from=b2bi-base --chown=${USER_NAME}:${GROUP_NAME} /ibm /ibm
   
   RUN mkdir /licenses \
       && ln -s /ibm/b2bi/install/licrfiles /licenses \
       && chown ${USER_NAME}:${GROUP_NAME} /licenses
   
   USER ${USER_NAME}
   
   ENTRYPOINT ["/ibm/b2bi/install/bin/b2biDockerStart.sh"]
   

2. Edit Dockerfile to change the repository and tag name from b2bi:latest to the appropriate repository and tag name for the Sterling B2B Integrator image you downloaded. Uncomment the LABEL section based on the product which you want to extend an image for.
3. Run the following command to extend the Sterling B2B Integrator Certified Container image to include the host user:

   
   docker build -t ${desired tag}:${product version} --build-arg 
   USER_ID=${host_user_id} --build-arg GROUP_ID=${host_user_group_id} --build-arg 
   USER_NAME=${host_user_name} --build-arg GROUP_NAME=${host_user_group_name} 
   ${path/to/dockerfile} 
   

   Note:

   • The build arguments host_user_id and host_user_group_id must be the uids for the selected host user and group. The build arguments host_user_name and host_user_group_name must be the names for the selected host user and group.
   • If --build-arg for USER_NAME/GROUP_NAME is missing from the command, b2biuser/b2bigroup is considered as the default USER_NAME/GROUP_NAME.
   • Use docker version 19.03.5 or above to build the image. If the version is lower that suggested one, then you must hard code the USER_NAME and GROUP_NAME in the command below, present in Dockerfile.

     COPY --from=b2bi-base --chown=<hard coded username>:<hard coded groupname> /ibm /ibm

4. Use the new image id/tag for all subsequent Certified Container installation configurations.
   If you use ibm-b2bi-prod Helm chart to deploy, then you must edit values.yaml and use same the user/group ID used during creation of image in Step 3.

   
   security:
        supplementalGroups: [5555]
        fsGroup: ${host_user_group_id}
        runAsUser: ${host_user_id}