Skip to content

Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots#278

Merged
NickLetts2 merged 2 commits into
mainfrom
copilot/harden-docker-runtime-file-ownership
May 15, 2026
Merged

Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots#278
NickLetts2 merged 2 commits into
mainfrom
copilot/harden-docker-runtime-file-ownership

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 15, 2026

Runtime application files were owned by the same non-root user running the process, allowing an attacker with code execution inside the container to modify or persist changes to deployed artefacts.

Pattern applied across all three services

# Before
COPY --from=builder --chown=appuser:appgroup /source ./target
USER appuser

# After
COPY --from=builder --chown=root:root /source ./target
RUN chmod -R a-w /app   # strip write bits for all users; /tmp remains world-writable
USER appuser

Changes

  • apps/app-frontend/Dockerfile — all three COPY instructions (standalone output, static files, public assets) changed to root:root + chmod -R a-w /app. Next.js standalone uses /tmp for ephemeral writes only.
  • apps/marketing-site/Dockerfiledist/ and node_modules/ copies changed to root:root + chmod -R a-w /app. Astro @astrojs/node has no runtime write requirement inside /app.
  • services/core-api/src/Curvit.Api/Dockerfile — publish copy changed to root:root + chmod -R a-w /app; USER appuser moved to after the chmod (was incorrectly placed before COPY). ASP.NET Core buffers form data to /tmp by default.

All containers continue to run as a non-root user (appuser).

Copilot AI linked an issue May 15, 2026 that may be closed by this pull request
9 tasks
Copy runtime artefacts as root:root and apply chmod -R a-w /app so
the non-root runtime user cannot modify deployed application files.

- apps/app-frontend/Dockerfile: COPY --chown=root:root + chmod -R a-w /app
- apps/marketing-site/Dockerfile: COPY --chown=root:root + chmod -R a-w /app
- services/core-api/src/Curvit.Api/Dockerfile: COPY --chown=root:root +
  chmod -R a-w /app + move USER appuser after chmod

Each service's ephemeral write needs (uploads, temp buffers) are
satisfied by the world-writable /tmp mount; no /app path requires
runtime write access.

Agent-Logs-Url: https://github.com/NickLetts2/Curvit/sessions/5b834229-6f26-48e1-a7bb-3e840815643f

Co-authored-by: NickLetts2 <90337962+NickLetts2@users.noreply.github.com>
Copilot AI changed the title [WIP] Harden Docker runtime file ownership to improve security Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots May 15, 2026
Copilot AI requested a review from NickLetts2 May 15, 2026 20:09
@NickLetts2 NickLetts2 marked this pull request as ready for review May 15, 2026 20:38
Copilot AI review requested due to automatic review settings May 15, 2026 20:38
@NickLetts2 NickLetts2 merged commit fa80d58 into main May 15, 2026
6 of 7 checks passed
Copilot AI review requested due to automatic review settings May 15, 2026 21:02
NickLetts2 added a commit that referenced this pull request Jun 1, 2026
…-file-ownership

Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots
@NickLetts2 NickLetts2 deleted the copilot/harden-docker-runtime-file-ownership branch June 2, 2026 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security Hotspots: Harden Docker runtime file ownership

2 participants