run binary as user nobody

[coip]

as an option to further apply PoLP

caveat emptor of course... unsure if

• stampede currently depends on root permissions, given the operations to perform
• & the host env this executes on may likely already be in a fairly locked-down state

cheers!

[coip]

supplemental datum 😄
https://medium.com/@lizrice/non-privileged-containers-based-on-the-scratch-image-a80105d6d341

[coip]

this most-likely wont be a clean merge actually.

quick pass, a few of the potential snags in pkg/node.go:

stampede/pkg/node.go

Line 50 in 9faf627

if _, err := os.Stat(stateFile); err == nil {

stampede/pkg/node.go

Line 147 in 9faf627

cmd = exec.Command("kubeadm", "init", "--apiserver-advertise-address", viper.GetString("advertise-address"))

stampede/pkg/node.go

Line 149 in 9faf627

cmd = exec.Command("kubeadm", "init")

stampede/pkg/node.go

Line 175 in 9faf627

func addNodeMicroK8s(response MessageResponse) {