Merge "Run HAProxy in a chroot jail"

ansible/roles/haproxy/templates/haproxy.cfg.j2

@@ -1,5 +1,8 @@
 {% set tls_bind_info = 'ssl crt /etc/haproxy/haproxy.pem' if kolla_enable_tls_external | bool else '' %}
 global
+  chroot /var/lib/haproxy
+  user haproxy
+  group haproxy
   daemon
   log /var/lib/kolla/heka/log local0
   maxconn 4000

docker/haproxy/Dockerfile.j2

@@ -15,6 +15,10 @@ RUN apt-get -y install --no-install-recommends \
 
 {% endif %}
 
+RUN usermod -a -G kolla haproxy \
+    && mkdir -p /var/lib/kolla/haproxy \
+    && chown -R haproxy: /var/lib /run
+
 COPY ensure_latest_config.sh /usr/local/bin/kolla_ensure_haproxy_latest_config
 RUN chmod 755 /usr/local/bin/kolla_ensure_haproxy_latest_config