security: add non-root user to Dockerfile (#120) #122
@ -28,15 +28,16 @@ RUN pip install --no-cache-dir --upgrade pip && \
|
||||
COPY ./app /usr/src/app/app
|
||||
|
||||
# Create non-root user and set up directories for volumes
|
||||
RUN addgroup --system appuser && adduser --system --ingroup appuser appuser
|
||||
RUN mkdir -p /usr/src/app/storage /usr/src/app/logs && \
|
||||
RUN addgroup --system appuser && \
|
||||
adduser --system --ingroup appuser appuser && \
|
||||
mkdir -p /usr/src/app/storage /usr/src/app/logs && \
|
||||
chown -R appuser:appuser /usr/src/app
|
||||
USER appuser
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
||||
CMD curl -f http://localhost:80/health || exit 1
|
||||
CMD curl -f http://localhost:8080/health || exit 1
|
||||
|
||||
# Start uvicorn
|
||||
ENV WEB_WORKERS=2
|
||||
CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 80 --workers $WEB_WORKERS"]
|
||||
CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port 8080 --workers $WEB_WORKERS"]
|
||||
@ -14,7 +14,7 @@ services:
|
||||
- ./storage:/usr/src/app/storage
|
||||
- ./logs:/usr/src/app/logs
|
||||
ports:
|
||||
- 801:80
|
||||
- 801:8080
|
||||
networks:
|
||||
- default
|
||||
# - nginx-proxy-manager_npm_network # Commented for local testing
|
||||
|
||||
Loading…
Reference in New Issue
Block a user