devaine/CodeRED-Astra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Migrate to non root container for best practice and to clear security warnings.

Browse source
This commit is contained in:
Christbru 2025-10-18 21:13:03 -05:00
commit 6df73ca465
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
rust-engine/Dockerfile
View file

@ -59,15 +59,20 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
cargo build --release cargo build --release
# --- Stage 2: Final, small image --- # --- Stage 2: Final, small image ---
FROM debian:bookworm-slim FROM debian:bookworm-slim
# Install only necessary runtime dependencies # Install only necessary runtime dependencies (no upgrade, just ca-certificates)
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \ RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
ca-certificates \
libssl3 \ # Add a non-root user for security
&& rm -rf /var/lib/apt/lists/* RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin appuser
# Copy the compiled binary from the builder stage # Copy the compiled binary from the builder stage
# Copy the compiled binary and set ownership
COPY --from=builder /usr/src/app/target/release/rust-engine /usr/local/bin/rust-engine COPY --from=builder /usr/src/app/target/release/rust-engine /usr/local/bin/rust-engine
RUN chown appuser:appuser /usr/local/bin/rust-engine
EXPOSE 8000 EXPOSE 8000
USER appuser
CMD ["rust-engine"] CMD ["rust-engine"]