Medium: Infrastructure issues — Docker, CI, unwanted permissions #30

New issue

Closed

opened 2026-06-10 15:16:01 +00:00 by Mark · 0 comments

Mark commented

2026-06-10 15:16:01 +00:00

Owner

Findings

M8: Dockerfile COPY books /app/books is wasted layer space — docker-compose mounts ./books:/app/books:ro at runtime, shadowing the COPY.
M9: CI workflow installs pip packages with --break-system-packages — a broken system Python cascades to the runner host.
M10: INTERNET permission in AndroidManifest with no network calls — misleading for an offline-first app.

Affected files

Dockerfile
docker-compose.yml
.forgejo/workflows/ci.yml
android/app/src/main/AndroidManifest.xml

## Findings - **M8**: Dockerfile `COPY books /app/books` is wasted layer space — docker-compose mounts `./books:/app/books:ro` at runtime, shadowing the COPY. - **M9**: CI workflow installs pip packages with `--break-system-packages` — a broken system Python cascades to the runner host. - **M10**: `INTERNET` permission in AndroidManifest with no network calls — misleading for an offline-first app. ## Affected files - `Dockerfile` - `docker-compose.yml` - `.forgejo/workflows/ci.yml` - `android/app/src/main/AndroidManifest.xml`