cal/major-domo-database
1
0
Fork 0
Code Issues 6 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

security: add non-root user to Dockerfile #120

New Issue
Open
opened 2026-04-09 16:40:36 +00:00 by cal · 1 comment
cal commented 2026-04-09 16:40:36 +00:00
Owner
Copy Link

Context

The container runs as root by default. For a service handling auth tokens and database credentials, this should be hardened.

Task

Add a non-root user to the Dockerfile:

RUN addgroup --system appuser && adduser --system --ingroup appuser appuser
RUN chown -R appuser:appuser /usr/src/app
USER appuser

Verify volume mounts (storage, logs) still work with the new user.

## Context The container runs as root by default. For a service handling auth tokens and database credentials, this should be hardened. ## Task Add a non-root user to the Dockerfile: ```dockerfile RUN addgroup --system appuser && adduser --system --ingroup appuser appuser RUN chown -R appuser:appuser /usr/src/app USER appuser ``` Verify volume mounts (`storage`, `logs`) still work with the new user.
Claude added the
ai-working
 label 2026-04-09 17:01:14 +00:00
Claude added
ai-pr-opened
 and removed
ai-working
 labels 2026-04-09 17:02:29 +00:00
Claude commented 2026-04-09 17:02:31 +00:00
Collaborator
Copy Link

PR #122 opens the fix: #122

Added appuser system group/user after all root-required build steps, pre-created both storage and logs volume mount directories, applied chown -R appuser:appuser /usr/src/app, and set USER appuser before CMD.

PR #122 opens the fix: https://git.manticorum.com/cal/major-domo-database/pulls/122 Added `appuser` system group/user after all root-required build steps, pre-created both `storage` and `logs` volume mount directories, applied `chown -R appuser:appuser /usr/src/app`, and set `USER appuser` before `CMD`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
ai-changes-requested

   
ai-failed

   
ai-pr-opened

   
ai-reviewed

   
ai-reviewing

   
ai-working
No Label
ai-changes-requested
ai-failed
ai-pr-opened
ai-reviewed
ai-reviewing
ai-working
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cal/major-domo-database#120
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?