Non-Root Delegate Installation

Updated 2 months ago by Michael Cretzman

By default, Harness Delegates use root access. You can install a different Docker image tag of the Delegate if you want to install and run the Delegate as non-root.

Harness Delegate images are publicly hosted on Docker Hub.

This topic described how to install and run a Delegate as non-root.

In this topic:

Before You Begin

Limitations

  • The Harness Delegate does NOT require root account access, but the Kubernetes and Docker Delegates run as root by default.
  • If you do not run the Delegate as root, be aware that you cannot install any software using a Delegate Initialization Script.

Step 1: Download the Delegate Config File

Download the Delegate config file as part of its installation.

For examples, see:

Option: Pick a Non-Root Type

Harness Delegate images are publicly hosted on Docker Hub and Harness has non-root options for different platforms:

Unless you are using OpenShift or a Universal Base Images (UBI), you will want to use to use delegate:non-root.

Step 2: Update the Delegate Image

In the Delegate config file, update the image tag to use the non-root image: harness/delegate:non-root.

For example, here's the Docker Delegate config file updated:

version: "3.7"
services:
  harness-ng-delegate:
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 2048M
    image: harness/delegate:non-root
    environment:
      - ACCOUNT_ID=xxx
      - ACCOUNT_SECRET=xxx
      - MANAGER_HOST_AND_PORT=https://app.harness.io
      - WATCHER_STORAGE_URL=https://app.harness.io/public/prod/premium/watchers
...

Here's the Kubernetes Delegate config file updated:

...
---

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    harness.io/name: foo
  name: foo
  namespace: harness-delegate-ng
spec:
  replicas: 1
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      harness.io/name: foo
  serviceName: ""
  template:
    metadata:
      labels:
        harness.io/name: foo
    spec:
      containers:
      - image: harness/delegate:non-root
        imagePullPolicy: Always
        name: harness-delegate-instance
        ports:
          - containerPort: 8080

...

Step 3: Install the Delegate

Install the Delegate as described in topics such as the following:

See Also

Please Provide Feedback