Merge pull request 'security: add non-root user to Dockerfile (#120)' (#122) from issue/120-security-add-non-root-user-to-dockerfile into main

Reviewed-on: #122

.gitea/workflows/docker-build.yml

@@ -58,6 +58,8 @@ jobs:
           tags: |
             manticorum67/major-domo-database:${{ steps.version.outputs.version }}
             manticorum67/major-domo-database:${{ steps.version.outputs.environment }}
+          build-args: |
+            BUILD_VERSION=${{ steps.version.outputs.version }}
           cache-from: type=registry,ref=manticorum67/major-domo-database:buildcache
           cache-to: type=registry,ref=manticorum67/major-domo-database:buildcache,mode=max
 

Dockerfile

@@ -1,16 +1,21 @@
 # Use official Python slim image
 FROM python:3.12-slim
 
+# Build-time version arg — passed by CI from the git tag
+ARG BUILD_VERSION=dev
+LABEL org.opencontainers.image.version=$BUILD_VERSION
+
 # Set Python optimizations
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PIP_NO_CACHE_DIR=1
+# Bake the CalVer version into the image so it's readable at runtime
+ENV APP_VERSION=$BUILD_VERSION
 
 WORKDIR /usr/src/app
 
 # Install system dependencies (PostgreSQL client libraries)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpq-dev \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
@@ -22,13 +27,17 @@ RUN pip install --no-cache-dir --upgrade pip && \
 # Copy application code
 COPY ./app /usr/src/app/app
 
-# Create directories for volumes
-RUN mkdir -p /usr/src/app/storage
+# Create non-root user and set up directories for volumes
+RUN addgroup --system appuser && \
+    adduser --system --ingroup appuser appuser && \
+    mkdir -p /usr/src/app/storage /usr/src/app/logs && \
+    chown -R appuser:appuser /usr/src/app
+USER appuser
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
-    CMD curl -f http://localhost:80/api/v3/current || exit 1
+    CMD curl -f http://localhost:8080/health || exit 1
 
 # Start uvicorn
 ENV WEB_WORKERS=2
-CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 80 --workers $WEB_WORKERS"]
+CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 8080 --workers $WEB_WORKERS"]

app/main.py

@@ -139,6 +139,11 @@ app.include_router(views.router)
 logger.info(f"Loaded all routers.")
 
 
+@app.get("/health")
+async def health():
+    return {"status": "ok", "version": os.environ.get("APP_VERSION", "dev")}
+
+
 @app.get("/api/docs", include_in_schema=False)
 async def get_docs(req: Request):
     logger.debug(req.scope)

docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - ./storage:/usr/src/app/storage
       - ./logs:/usr/src/app/logs
     ports:
-      - 801:80
+      - 801:8080
     networks:
       - default
       # - nginx-proxy-manager_npm_network  # Commented for local testing
@@ -23,9 +23,6 @@ services:
       - LOG_LEVEL=${LOG_LEVEL}
       - API_TOKEN=${API_TOKEN}
       - TZ=${TZ}
-      - WORKERS_PER_CORE=1.5
-      - TIMEOUT=120
-      - GRACEFUL_TIMEOUT=120
       - DATABASE_TYPE=postgresql
       - POSTGRES_HOST=sba_postgres
       - POSTGRES_DB=${SBA_DATABASE}