The Tomcat service should be executed with a non-root user

[gkhays]

Security best practices indicate Tomcat should not be run as root. Even though we can mitigate dropping into a privileged shell within a container, the issue can be avoided through moderate effort.

The Docker Official Image packaging for Postgres provides a good example, albeit for a different service.

References

1. Ghostcat bug impacts all Apache Tomcat versions released in the last 13 years
2. SELinux, Apache, and Tomcat – Tomcat – A Securely A Securely Implemented Web Application Server
3. Improving Apache Tomcat Security - A Step By Step Guide

[dermot-hardy]

Thanks Garve. We did discuss this in #4 and CAF-4050 was raised for it but we never got to it. Are you working on a PR for this? Thanks, Dermot.

[dermot-hardy]

OCTUS52I353761