Error running on Kubernetes with runAsNonRoot: true and allowPrivilegeEscalation: false

[hsahmed]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

The use of sudo in run.sh prevent the realtime container from running on Kubernetes with securityContext settings runAsNonRoot: true and allowPrivilegeEscalation: false

To Reproduce

Create a deployment on kubernetes with:

Pod security context:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  seccompProfile:
    type: RuntimeDefault
Container securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

Or use helm chart from https://github.com/supabase-community/supabase-kubernetes with values:

deployment:
  realtime:
    podSecurityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      seccompProfile:
        type: RuntimeDefault
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

The pods will fail to start.

Expected behavior

Realtime docker containers should allow running as non-root:

System information

• OS: Linux

Additional context

One way to fix this (not tested) is to use sudo only if running as root, otherwise run the migrations as the user running the container:

if (( EUID == 0 )); then
    sudo -E -u nobody -- /app/bin/migrate
else
    /app/bin/migrate
fi

if [ "${SEED_SELF_HOST-}" = true ]; then
    echo "Seeding selfhosted Realtime"
    if (( EUID == 0 )); then
        sudo -E -u nobody /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)'
    else
        /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)'
    fi
fi