Skip to content

Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots #278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NickLetts2 merged 2 commits into from
May 15, 2026
Merged

Security: harden Docker runtime file ownership to resolve docker:S6504 hotspots #278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dbb7e49
Initial plan
Copilot May 15, 2026
047a17a
security: harden Docker runtime file ownership (docker:S6504)
Copilot May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions apps/app-frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,13 @@ RUN addgroup -S appgroup && adduser -S appuser -G appgroup
# In Docker the workspace root has no apps/package.json so Next.js sets
# outputFileTracingRoot to the app directory — standalone output lands
# directly at .next/standalone/server.js (no subdirectory nesting).
COPY --from=builder --chown=appuser:appgroup /repo/apps/app-frontend/.next/standalone ./
COPY --from=builder --chown=appuser:appgroup /repo/apps/app-frontend/.next/static ./.next/static
COPY --from=builder --chown=appuser:appgroup /repo/apps/app-frontend/public ./public
# Files are owned by root so the runtime user cannot tamper with deployed artefacts.
COPY --from=builder --chown=root:root /repo/apps/app-frontend/.next/standalone ./
COPY --from=builder --chown=root:root /repo/apps/app-frontend/.next/static ./.next/static
COPY --from=builder --chown=root:root /repo/apps/app-frontend/public ./public
# Remove write permission for all users on application files (immutable container).
# Next.js standalone only needs /tmp for any ephemeral writes, which is world-writable.
RUN chmod -R a-w /app

USER appuser
EXPOSE 3000
Expand Down
8 changes: 6 additions & 2 deletions apps/marketing-site/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,12 @@ RUN apk upgrade --no-cache && \
/usr/local/bin/corepack

RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
# Files are owned by root so the runtime user cannot tamper with deployed artefacts.
COPY --from=builder --chown=root:root /app/dist ./dist
COPY --from=builder --chown=root:root /app/node_modules ./node_modules
# Remove write permission for all users on application files (immutable container).
# The Astro @astrojs/node adapter only needs /tmp for any ephemeral writes.
RUN chmod -R a-w /app

ENV NODE_ENV=production
ENV HOST=0.0.0.0
Expand Down
7 changes: 6 additions & 1 deletion services/core-api/src/Curvit.Api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,13 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine@sha256:60eb031b554df75a4b9f3582
WORKDIR /app
RUN apk update && apk upgrade --no-cache && apk add --no-cache krb5-libs && \
addgroup -S appgroup && adduser -S appuser -G appgroup
# Files are owned by root so the runtime user cannot tamper with deployed artefacts.
COPY --from=build --chown=root:root /app/publish .
# Remove write permission for all users on application files (immutable container).
# ASP.NET Core uses /tmp for ephemeral writes (e.g. form-file buffers); no
# writable path is needed inside /app.
RUN chmod -R a-w /app
USER appuser
COPY --from=build --chown=appuser:appgroup /app/publish .
EXPOSE 5000
ENV ASPNETCORE_URLS=http://+:5000
ENTRYPOINT ["dotnet", "Curvit.Api.dll"]
Loading