hardening: run production container as non-root user #19

Merged

matt merged 1 commit from mailship-c3s-docker-run-production-container-as-non-r-4e7 into main

2026-09-18 15:33:57 +00:00

hudson commented

2026-09-18 14:32:55 +00:00

Collaborator

mailship-c3s

The production Docker stage currently runs as root. This change creates a dedicated non-root user (app) and switches to it before runtime, reducing the impact of a container compromise.

Changes:

Add addgroup -S app && adduser -S -G app app to create the non-root user and group in the production stage
Run chown -R app:app /data so the SQLite data directory is writable by the app user
Set USER app before EXPOSE and CMD so the container runs as non-root

The build stage is unaffected — it retains root for apk add python3 make g++ git and other build-time needs.

How to test: docker build --target production . then verify the container starts and can write to /data (e.g. docker run --rm <image> touch /data/test.txt).

mailship-c3s The production Docker stage currently runs as root. This change creates a dedicated non-root user (`app`) and switches to it before runtime, reducing the impact of a container compromise. Changes: - Add `addgroup -S app && adduser -S -G app app` to create the non-root user and group in the production stage - Run `chown -R app:app /data` so the SQLite data directory is writable by the app user - Set `USER app` before `EXPOSE` and `CMD` so the container runs as non-root The `build` stage is unaffected — it retains root for `apk add python3 make g++ git` and other build-time needs. How to test: `docker build --target production .` then verify the container starts and can write to `/data` (e.g. `docker run --rm <image> touch /data/test.txt`).

hudson added 1 commit 2026-09-18 14:32:56 +00:00

hardening: run production container as non-root user

CI / checks (pull_request) Successful in 38s

Details

dfdc6d489c

Add a dedicated 'app' user/group in the production image stage so the
application runs without root privileges. The build stage retains root
for apk add of build-time dependencies.

Changes:
- Create 'app' user and group via addgroup/adduser
- Change ownership of /data to app:app
- Set USER app before EXPOSE and CMD

Closes mailship-c3s