Security hardening: non-root user, VNC password, seccomp #6

New issue

Closed

opened 2026-05-14 04:47:39 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 04:47:39 +00:00

Owner

Several security gaps exist in the current setup:

Root-only container: All processes run as root. Add a testenv user and run supervisord/X11 apps under it.
No VNC password: x11vnc -nopw allows anyone with network access to view/control the desktop. Add password generation or token auth.
Overly broad capabilities: SYS_ADMIN + seccomp:unconfined in docker-compose.yml is excessive. Document minimum required capabilities.
No resource limits: Docker Compose has no CPU/memory limits. Add sensible defaults.

Files to modify:

Dockerfile — create testenv user, adjust permissions
docker-compose.yml — add user: testenv, resource limits, narrower capabilities
supervisord.conf — run programs as testenv user
entrypoint.sh — handle privilege drop

Why: Running GUI automation with root privileges and open VNC is a significant attack surface, especially in shared CI environments.

Several security gaps exist in the current setup: 1. **Root-only container:** All processes run as root. Add a `testenv` user and run supervisord/X11 apps under it. 2. **No VNC password:** `x11vnc -nopw` allows anyone with network access to view/control the desktop. Add password generation or token auth. 3. **Overly broad capabilities:** `SYS_ADMIN` + `seccomp:unconfined` in docker-compose.yml is excessive. Document minimum required capabilities. 4. **No resource limits:** Docker Compose has no CPU/memory limits. Add sensible defaults. Files to modify: - `Dockerfile` — create `testenv` user, adjust permissions - `docker-compose.yml` — add `user: testenv`, resource limits, narrower capabilities - `supervisord.conf` — run programs as `testenv` user - `entrypoint.sh` — handle privilege drop **Why:** Running GUI automation with root privileges and open VNC is a significant attack surface, especially in shared CI environments.