Run Docker as a non-root user #24

New Issue

natecj · 2024-12-28T03:56:38+01:00

natecj commented

2024-12-28 03:56:38 +01:00

The container currently runs as root which is less than ideal from a security perspective. I believe something like the following would work. I don't have time to test this myself right now, but will try when I do if someone else has not gotten to it first.

ARG USERNAME=bricktracker
ARG USER_UID=1000
ARG USER_GID=$USER_UID

RUN groupadd -g $USER_GID $USERNAME \
    && useradd -m -u $USER_UID -g $USERNAME $USERNAME \
    && chown -R $USER_UID:$USER_GID /app

USER $USERNAME

On a similar note, you could make the HTTP port an environment variable so it can also be overridden:

ENV HTTP_PORT=3333

EXPOSE $HTTP_PORT

CMD ["gunicorn","--bind","0.0.0.0:$HTTP_PORT","app:app","--worker-class","eventlet"]

The container currently runs as root which is less than ideal from a security perspective. I believe something like the following would work. I don't have time to test this myself right now, but will try when I do if someone else has not gotten to it first. ``` ARG USERNAME=bricktracker ARG USER_UID=1000 ARG USER_GID=$USER_UID RUN groupadd -g $USER_GID $USERNAME \ && useradd -m -u $USER_UID -g $USERNAME $USERNAME \ && chown -R $USER_UID:$USER_GID /app USER $USERNAME ``` On a similar note, you could make the HTTP port an environment variable so it can also be overridden: ``` ENV HTTP_PORT=3333 EXPOSE $HTTP_PORT CMD ["gunicorn","--bind","0.0.0.0:$HTTP_PORT","app:app","--worker-class","eventlet"] ```

FrederikBaerentsen added the

Kind/Security

Priority

Low

labels 2024-12-28 10:01:22 +01:00

FrederikBaerentsen commented

2024-12-28 10:02:00 +01:00

I agree but this is very low priority for me. This app is meant for local deployment and is not production ready.

Sign in to join this conversation.