Non-Root Delegate Installation

Updated 2 months ago by Michael Cretzman

By default, Harness Delegates use root access. You can install a different Docker image tag of the Delegate if you want to install and run the Delegate as non-root.

Harness Delegate images are publicly hosted on Docker Hub.

This topic described how to install and run a Delegate as non-root.

In this topic:

Before You Begin

Limitations

  • The Harness Delegate does NOT require root account access, but the Kubernetes and Docker Delegates run as root by default.
  • If you do not run the Delegate as root, be aware that you cannot install any software using a Delegate Initialization Script.

Step 1: Download the Delegate Config File

Download the Delegate config file as part of its installation.

For examples, see:

Option: Pick a Non-Root Type

Harness Delegate images are publicly hosted on Docker Hub and Harness has non-root options for different platforms:

Unless you are using OpenShift or a Universal Base Images (UBI), you will want to use to use delegate:non-root.

Step 2: Update the Delegate Image

In the Delegate config file, update the image tag to use the non-root image: harness/delegate:non-root.

For example, here's the Docker Delegate config file updated:

version: "3.7"
services:
harness-ng-delegate:
restart: unless-stopped
deploy:
resources:
limits:
cpus: "0.5"
memory: 2048M
image: harness/delegate:non-root
environment:
- ACCOUNT_ID=xxx
- ACCOUNT_SECRET=xxx
- MANAGER_HOST_AND_PORT=https://app.harness.io
- WATCHER_STORAGE_URL=https://app.harness.io/public/prod/premium/watchers
...

Here's the Kubernetes Delegate config file updated:

...
---

apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
harness.io/name: foo
name: foo
namespace: harness-delegate-ng
spec:
replicas: 1
podManagementPolicy: Parallel
selector:
matchLabels:
harness.io/name: foo
serviceName: ""
template:
metadata:
labels:
harness.io/name: foo
spec:
containers:
- image: harness/delegate:non-root
imagePullPolicy: Always
name: harness-delegate-instance
ports:
- containerPort: 8080

...

Step 3: Install the Delegate

Install the Delegate as described in topics such as the following:

See Also


Please Provide Feedback