Merge pull request 'security: add non-root user to Dockerfile (#120)' (#122) from issue/120-security-add-non-root-user-to-dockerfile into main

Reviewed-on: #122

.gitea/workflows/docker-build.yml

@@ -58,6 +58,8 @@ jobs:
           tags: |
             manticorum67/major-domo-database:${{ steps.version.outputs.version }}
             manticorum67/major-domo-database:${{ steps.version.outputs.environment }}
+          build-args: |
+            BUILD_VERSION=${{ steps.version.outputs.version }}
           cache-from: type=registry,ref=manticorum67/major-domo-database:buildcache
           cache-to: type=registry,ref=manticorum67/major-domo-database:buildcache,mode=max
 

Dockerfile

@@ -1,16 +1,21 @@
 # Use official Python slim image
 FROM python:3.12-slim
 
+# Build-time version arg — passed by CI from the git tag
+ARG BUILD_VERSION=dev
+LABEL org.opencontainers.image.version=$BUILD_VERSION
+
 # Set Python optimizations
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PIP_NO_CACHE_DIR=1
+# Bake the CalVer version into the image so it's readable at runtime
+ENV APP_VERSION=$BUILD_VERSION
 
 WORKDIR /usr/src/app
 
 # Install system dependencies (PostgreSQL client libraries)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpq-dev \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
@@ -22,13 +27,17 @@ RUN pip install --no-cache-dir --upgrade pip && \
 # Copy application code
 COPY ./app /usr/src/app/app
 
-# Create directories for volumes
-RUN mkdir -p /usr/src/app/storage
+# Create non-root user and set up directories for volumes
+RUN addgroup --system appuser && \
+    adduser --system --ingroup appuser appuser && \
+    mkdir -p /usr/src/app/storage /usr/src/app/logs && \
+    chown -R appuser:appuser /usr/src/app
+USER appuser
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
-    CMD curl -f http://localhost:80/api/v3/current || exit 1
+    CMD curl -f http://localhost:8080/health || exit 1
 
 # Start uvicorn
 ENV WEB_WORKERS=2
-CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 80 --workers $WEB_WORKERS"]
+CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 8080 --workers $WEB_WORKERS"]

app/main.py

@@ -139,6 +139,11 @@ app.include_router(views.router)
 logger.info(f"Loaded all routers.")
 
 
+@app.get("/health")
+async def health():
+    return {"status": "ok", "version": os.environ.get("APP_VERSION", "dev")}
+
+
 @app.get("/api/docs", include_in_schema=False)
 async def get_docs(req: Request):
     logger.debug(req.scope)

docker-compose.prod.yml

@@ -1,118 +0,0 @@
-version: '3'
-
-networks:
-  nginx-proxy-manager_npm_network:
-    external: true
-
-services:
-  api:
-    # build: .
-    image: manticorum67/major-domo-database:production
-    restart: unless-stopped
-    container_name: sba_db_api
-    volumes:
-      - ./storage:/usr/src/app/storage
-      - ./logs:/usr/src/app/logs
-    ports:
-      - 801:80
-    networks:
-      - default
-      - nginx-proxy-manager_npm_network
-    environment:
-      - TESTING=False
-      - LOG_LEVEL=${LOG_LEVEL}
-      - API_TOKEN=${API_TOKEN}
-      - TZ=${TZ}
-      - DATABASE_TYPE=postgresql
-      - POSTGRES_HOST=sba_postgres
-      - POSTGRES_DB=${SBA_DATABASE}
-      - POSTGRES_USER=${SBA_DB_USER}
-      - POSTGRES_PASSWORD=${SBA_DB_USER_PASSWORD}
-      - WEB_WORKERS=4
-      - REDIS_HOST=sba_redis
-      - REDIS_PORT=6379
-      - REDIS_DB=0
-      - CACHE_ENABLED=False
-    depends_on:
-      - postgres
-      - redis
-
-  postgres:
-    image: postgres:17-alpine
-    restart: unless-stopped
-    container_name: sba_postgres
-    environment:
-      - POSTGRES_DB=${SBA_DATABASE}
-      - POSTGRES_USER=${SBA_DB_USER}
-      - POSTGRES_PASSWORD=${SBA_DB_USER_PASSWORD}
-      - TZ=${TZ}
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-      - ./logs:/var/log/postgresql
-    ports:
-      - "5432:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${SBA_DB_USER} -d ${SBA_DATABASE}"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    container_name: sba_redis
-    ports:
-      - "6379:6379"
-    volumes:
-      - redis_data:/data
-    environment:
-      - TZ=${TZ}
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-    command: redis-server --appendonly yes
-
-  adminer:
-    image: adminer:latest
-    restart: unless-stopped
-    container_name: sba_adminer
-    ports:
-      - "8080:8080"
-    environment:
-      - ADMINER_DEFAULT_SERVER=sba_postgres
-      - TZ=${TZ}
-      # - ADMINER_DESIGN=pepa-linha-dark
-    depends_on:
-      - postgres
-
-  sync-prod:
-    image: alpine:latest
-    container_name: sba_sync_prod
-    volumes:
-      - ./scripts:/scripts
-      - /home/cal/.ssh:/tmp/ssh:ro
-    environment:
-      - SBA_DB_USER=${SBA_DB_USER}
-      - SBA_DATABASE=${SBA_DATABASE}
-      - SBA_DB_USER_PASSWORD=${SBA_DB_USER_PASSWORD}
-    command: >
-      sh -c "
-      cp -r /tmp/ssh /root/.ssh &&
-      chmod 700 /root/.ssh &&
-      chmod 600 /root/.ssh/* &&
-      chown -R root:root /root/.ssh &&
-      /scripts/sync_from_prod.sh
-      "
-    profiles: ["sync"]
-    depends_on:
-      - postgres
-    networks:
-      - default
-
-volumes:
-  postgres_data:
-  redis_data:

docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - ./storage:/usr/src/app/storage
       - ./logs:/usr/src/app/logs
     ports:
-      - 801:80
+      - 801:8080
     networks:
       - default
       # - nginx-proxy-manager_npm_network  # Commented for local testing
@@ -23,9 +23,6 @@ services:
       - LOG_LEVEL=${LOG_LEVEL}
       - API_TOKEN=${API_TOKEN}
       - TZ=${TZ}
-      - WORKERS_PER_CORE=1.5
-      - TIMEOUT=120
-      - GRACEFUL_TIMEOUT=120
       - DATABASE_TYPE=postgresql
       - POSTGRES_HOST=sba_postgres
       - POSTGRES_DB=${SBA_DATABASE}