From ebf1f8f8b4f909788523e609a2fce351d012aa1f Mon Sep 17 00:00:00 2001 From: Edwin van den Houdt Date: Thu, 30 Jul 2026 10:11:54 +0200 Subject: [PATCH] fix(backend): run the prod image as non-root (semgrep, live Gitea finding) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pushed WP-30 item-5 Dockerfile predated the semgrep triage's local run — CI's now-blocking semgrep gate caught what local verification couldn't: dockerfile.security.missing-user-entrypoint (no USER, container runs as root). mcr.microsoft.com/dotnet/aspnet:10.0 ships a pre-created non-root user for exactly this ($APP_UID, uid/gid 1654) — switched to it, with --chown on both COPY layers so the app can still create/write bigregister.db (WP-22, a relative-path SQLite connection string resolved against the container's /app cwd) as that user. Verified for real: rebuilt, confirmed `whoami` is `app` inside the container, ran it and curled a live GET /api/v1/brief/preview (200), confirmed bigregister.db was created and is actually owned by app:app. Full semgrep re-run (this file didn't exist during the original triage) is now 0 findings. Co-Authored-By: Claude Sonnet 5 --- backend/Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index 366b351..4e41364 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -8,8 +8,11 @@ RUN dotnet publish backend/src/BigRegister.Api -c Release -o /app FROM mcr.microsoft.com/dotnet/aspnet:10.0 WORKDIR /app -COPY --from=build /app . +COPY --chown=$APP_UID:$APP_UID --from=build /app . # LetterHtml.Render (WP-25) walks up from AppContext.BaseDirectory looking for a sibling # public/letter.css (the FE⇄BE letter contract) — this keeps that lookup working here too. -COPY public ./public +COPY --chown=$APP_UID:$APP_UID public ./public +# $APP_UID (uid/gid 1654, "app") is baked into this base image for exactly this purpose — +# non-root, and chown'd above so it can still create/write bigregister.db (WP-22) at /app. +USER $APP_UID ENTRYPOINT ["dotnet", "BigRegister.Api.dll"]