Mark/docker_backup
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

[Security] MEDIUM: 4 issue(s) found in docker_backup #29

New issue
Closed
opened 2026-05-14 23:23:43 +00:00 by Mark · 2 comments
Mark commented 2026-05-14 23:23:43 +00:00
Owner
Copy link

Security Scan Results for docker_backup

Severity: MEDIUM
Findings: 4

1. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: Dockerfile

2. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: agent/Dockerfile

3. docker_root_user

  • Details: Dockerfile does not set a non-root USER — container runs as root
  • File: backend/Dockerfile

4. auth_flaw

  • Details: Potential security issue (insecure_random) in dist/assets/index-DDJtv-ld.js
  • File: dist/assets/index-DDJtv-ld.js
  • Pattern: insecure_random

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `docker_backup` **Severity:** MEDIUM **Findings:** 4 ### 1. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `Dockerfile` ### 2. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `agent/Dockerfile` ### 3. docker_root_user - **Details:** Dockerfile does not set a non-root USER — container runs as root - **File:** `backend/Dockerfile` ### 4. auth_flaw - **Details:** Potential security issue (insecure_random) in dist/assets/index-DDJtv-ld.js - **File:** `dist/assets/index-DDJtv-ld.js` - **Pattern:** `insecure_random` --- *This issue was auto-generated by the security sweep cron job.*
Mark commented 2026-05-16 09:14:26 +00:00
Author
Owner
Copy link

Ops Pipeline — No Executable Procedure

Research did not produce any executable commands.

Analysis complete. Let me lay out the findings clearly.

All 3 docker_root_user findings are false positives. Every Dockerfile already has a non-root user:

  • Dockerfile (line 16): USER appuser ✓
  • agent/Dockerfile (line 22): USER appuser ✓
  • backend/Dockerfile (line 29): USER appuser ✓

All three create the user group and user, chown the /app directory, and set USER appuser before the CMD. The scanner appears not to have parsed the multi-stage build in `backend/Doc

## Ops Pipeline — No Executable Procedure Research did not produce any executable commands. **Analysis complete.** Let me lay out the findings clearly. **All 3 `docker_root_user` findings are false positives.** Every Dockerfile already has a non-root user: - `Dockerfile` (line 16): `USER appuser` ✓ - `agent/Dockerfile` (line 22): `USER appuser` ✓ - `backend/Dockerfile` (line 29): `USER appuser` ✓ All three create the user group and user, `chown` the `/app` directory, and set `USER appuser` before the `CMD`. The scanner appears not to have parsed the multi-stage build in `backend/Doc
Mark closed this issue 2026-05-30 14:21:37 +00:00
Mark commented 2026-05-30 14:21:37 +00:00
Author
Owner
Copy link

Already fixed — all three Dockerfiles (Dockerfile, agent/Dockerfile, backend/Dockerfile) already have USER appuser with user/group creation and chown. The dist/ insecure_random finding is a build artifact; it will resolve on next build. Closing.

Already fixed — all three Dockerfiles (`Dockerfile`, `agent/Dockerfile`, `backend/Dockerfile`) already have `USER appuser` with user/group creation and `chown`. The `dist/` insecure_random finding is a build artifact; it will resolve on next build. Closing.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:lint-failed

   
blocked:needs-decision

   
blocked:no-changes

   
blocked:no-procedure

   
blocked:verify-failed

   
bug

Something is not working correctly

  
feature-request

   
in-progress

   
needs-decompose

Ready to be decomposed into sub-issues

  
needs-triage

   
ops-task

Operations task — install, configure, deploy, API calls

  
quickfix

   
security/high

High severity security issue

  
security/low

Low severity security issue

  
security/medium

Medium severity security issue

  
test-coverage

Test coverage review / gap report

  
triage-approved

Approved by triage pipeline

No labels
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:lint-failed
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:verify-failed
bug
feature-request
in-progress
needs-decompose
needs-triage
ops-task
quickfix
security/high
security/low
security/medium
test-coverage
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/docker_backup#29
No description provided.