Skip to content

Commit a0cd44b

Browse files
authored
feat: rootless docker container (#893)
As per [OWASP's Docker Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html), it is recommended to set a user instead of running the container as root. ```bash virgo@lenovo:~$ docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ee568549229f cyclonedx-py:latest "/bin/bash" About a minute ago Up About a minute nifty_swirles virgo@lenovo:~$ docker exec -it ee568549229f sh -c "id" uid=1000(cyclonedx) gid=1000(cyclonedx) groups=1000(cyclonedx) ``` :arrow_up: Now the container is running as a standard user. Signed-off-by: virgo-o <virgoj@protonmail.com>
1 parent fcc1d75 commit a0cd44b

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

Dockerfile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ ARG VERSION
55
ARG CDX_PATH=/opt/cyclonedx-py
66
ARG CDX_VENV=${CDX_PATH}/venv
77

8+
RUN addgroup --system --gid 1000 cyclonedx \
9+
&& adduser --system --shell /bin/bash --uid 1000 --ingroup cyclonedx cyclonedx
10+
811
RUN mkdir -p "${CDX_PATH}"
912
RUN python -m venv --without-pip "${CDX_VENV}"
1013
ENV VIRTUAL_ENV=${CDX_VENV}
@@ -19,4 +22,5 @@ RUN pip --python "${CDX_VENV}" \
1922
"cyclonedx-bom==${VERSION}" --find-links "file://${CDX_PATH}/dist"
2023
RUN rm -rf ${CDX_PATH}/dist
2124

25+
USER cyclonedx
2226
ENTRYPOINT ["cyclonedx-py"]

0 commit comments

Comments
 (0)