ehoandClaude Sonnet 5
ebf1f8f8b4
CI / changes (push) Successful in 8s
CI / lint (push) Successful in 10s
CI / frontend (push) Successful in 13s
CI / storybook-a11y (push) Successful in 17s
CI / backend (push) Successful in 1m45s
CI / semgrep (push) Successful in 1m9s
CI / e2e (push) Successful in 2m53s
CI / api-client-drift (push) Successful in 1m46s
The pushed WP-30 item-5 Dockerfile predated the semgrep triage's local run — CI's now-blocking semgrep gate caught what local verification couldn't: dockerfile.security.missing-user-entrypoint (no USER, container runs as root). mcr.microsoft.com/dotnet/aspnet:10.0 ships a pre-created non-root user for exactly this ($APP_UID, uid/gid 1654) — switched to it, with --chown on both COPY layers so the app can still create/write bigregister.db (WP-22, a relative-path SQLite connection string resolved against the container's /app cwd) as that user. Verified for real: rebuilt, confirmed `whoami` is `app` inside the container, ran it and curled a live GET /api/v1/brief/preview (200), confirmed bigregister.db was created and is actually owned by app:app. Full semgrep re-run (this file didn't exist during the original triage) is now 0 findings. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
943 B
Docker
19 lines
943 B
Docker
# WP-30: lean deployable image (optional — not used by the dev demo, which keeps the SDK
|
|
# image in the root docker-compose.yml for `dotnet run` hot-reload). Build from the repo
|
|
# root: `docker build -f backend/Dockerfile .`
|
|
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
|
|
WORKDIR /src
|
|
COPY . .
|
|
RUN dotnet publish backend/src/BigRegister.Api -c Release -o /app
|
|
|
|
FROM mcr.microsoft.com/dotnet/aspnet:10.0
|
|
WORKDIR /app
|
|
COPY --chown=$APP_UID:$APP_UID --from=build /app .
|
|
# LetterHtml.Render (WP-25) walks up from AppContext.BaseDirectory looking for a sibling
|
|
# public/letter.css (the FE⇄BE letter contract) — this keeps that lookup working here too.
|
|
COPY --chown=$APP_UID:$APP_UID public ./public
|
|
# $APP_UID (uid/gid 1654, "app") is baked into this base image for exactly this purpose —
|
|
# non-root, and chown'd above so it can still create/write bigregister.db (WP-22) at /app.
|
|
USER $APP_UID
|
|
ENTRYPOINT ["dotnet", "BigRegister.Api.dll"]
|