From 69f0009d2d8d19cf3d32907507f55a178690c025 Mon Sep 17 00:00:00 2001 From: "courtmanr@gmail.com" Date: Sun, 1 Jun 2025 21:40:04 +0100 Subject: [PATCH] fix: change appuser to uid:gid 1000:1000 for security - Use standard user uid:gid 1000:1000 instead of 100:101 (postfix:crontab) - Add user override in docker-compose.yml to ensure consistent uid:gid - Prevents .env files from having system service account permissions - Addresses critical security concern in issue #109 --- Dockerfile | 4 ++-- docker-compose.yml | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 3ef72bf26..762d3cf92 100644 --- a/Dockerfile +++ b/Dockerfile @@ -28,8 +28,8 @@ FROM node:18-alpine WORKDIR /usr/src/app -# Create a non-root user and group -RUN addgroup -S appgroup && adduser -S appuser -G appgroup +# Create a non-root user and group with uid:gid 1000:1000 (standard user) +RUN addgroup -g 1000 appgroup && adduser -u 1000 -G appgroup -s /bin/sh -D appuser # Copy necessary files from builder stage # Copy node_modules first (can be large) diff --git a/docker-compose.yml b/docker-compose.yml index 1c75a1c43..50f871cb4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,6 +7,7 @@ services: # image: rcourtman/pulse:latest # Use the pre-built image from Docker Hub container_name: pulse restart: unless-stopped + user: "1000:1000" # Run as standard user, not system service accounts ports: # Map container port 7655 to host port 7655 # You can change the host port (left side) if 7655 is already in use on your host