bug: Dockerfiles run as root — add non-root USER directive #30
Labels
No labels
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-implement
blocked:gate-plan
blocked:needs-attention
blocked:needs-decision
blocked:needs-human
blocked:no-procedure
blocked:preflight
bug
feature-request
in-progress
lint-cleanup
needs-decompose
needs-triage
ops-task
quickfix
security/medium
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Mark/msp_c2#30
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
2 Dockerfiles do not set a non-root USER, causing containers to run as root:
frontend/Dockerfile.prod
frontend/Dockerfile
Recommendation: add USER directive after package installation. Use a non-privileged UID like 1000.
Fixed in commit. Closing.