$ show tianon/gosu
gosu is a minimal Go CLI tool designed to drop privileges inside Docker containers by switching to a specified user and group before executing a command. It directly uses the same user/group parsing code from Docker's libcontainer (via github.com/moby/sys/user) and performs setuid/setgid/setgroups syscalls, then exec's the target command. The binary is statically compiled with CGO disabled, making it portable across Linux architectures. The repository includes comprehensive test suites (Alpine and Debian Dockerfiles), CI workflows that build and test multiple architectures, and a govulncheck wrapper for vulnerability scanning. The codebase is small, focused, and well-maintained, with active development and weekly CI runs.
The LLM identified 2 files worth highlighting for reuse:
A self-contained function that parses a user:group spec using moby/sys/user, then performs setgroups, setgid, setuid syscalls and sets HOME. It is cleanly separated from main.go and could be extracted as a reusable library for any Go program needing to switch to a different user before executing a process. Demonstrates proper handling of defaults and edge cases.
A shell script wrapper around Go's govulncheck that allows excluding known false positives (e.g., CVEs that don't apply to the binary). It also provides a Docker-based fallback if govulncheck is not installed locally. This pattern is reusable for any Go project that wants to run govulncheck in CI while managing exclusions for vulnerabilities that are not actually exploitable.