[self-hosted] add netbird server #5232

coderabbitai · 2026-02-09T15:00:52Z

⚠️ Potential issue | 🟠 Major

Container runs as root; add a non-root user and reorder layers.

Several improvements for this Dockerfile:

Security: The container runs as root (flagged by Trivy DS002). Add a dedicated user.

Layer ordering: COPY should precede ENTRYPOINT/CMD for readability and better cache invalidation ordering.

APT cleanup: Also remove /var/lib/apt/lists/* to minimize image size.

Proposed fix

FROM ubuntu:24.04 -RUN apt update && apt install -y ca-certificates && rm -fr /var/cache/apt -ENTRYPOINT [ "/go/bin/netbird-server" ] -CMD ["--config", "/etc/netbird/config.yaml"] -COPY netbird-server /go/bin/netbird-server +RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \ + && rm -rf /var/cache/apt /var/lib/apt/lists/* +RUN useradd -r -s /usr/sbin/nologin netbird +COPY netbird-server /go/bin/netbird-server +USER netbird +ENTRYPOINT [ "/go/bin/netbird-server" ] +CMD ["--config", "/etc/netbird/config.yaml"]

🧰 Tools

🪛 Trivy (0.58.1)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents

In `@combined/Dockerfile` around lines 1 - 5, Reorder the Dockerfile to COPY the built binary before setting ENTRYPOINT/CMD and add a non-root user: update the layer order so the COPY netbird-server /go/bin/netbird-server happens before ENTRYPOINT and CMD, install packages with apt update && apt install -y ca-certificates && rm -rf /var/cache/apt /var/lib/apt/lists/* to clean apt artifacts, create a dedicated user (e.g., netbird) and group, chown the installed binary to that user and switch to USER netbird (or use USER with a non-root UID) so the container does not run as root, and keep ENTRYPOINT ["/go/bin/netbird-server"] and CMD ["--config", "/etc/netbird/config.yaml"] at the end.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[self-hosted] add netbird server #5232

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

-Original file line number
+Diff line change
@@ -0,0 +1,5 @@
+    FROM ubuntu:24.04
+    RUN apt update && apt install -y ca-certificates && rm -fr /var/cache/apt
+    ENTRYPOINT [ "/go/bin/netbird-server" ]
+    CMD ["--config", "/etc/netbird/config.yaml"]
+    COPY netbird-server /go/bin/netbird-server

Uh oh!

Uh oh!

[self-hosted] add netbird server #5232

Uh oh!

[self-hosted] add netbird server #5232

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!