From 573dd68d76a689d49a2ebaca059a366331a9beb9 Mon Sep 17 00:00:00 2001 From: nuthalapativarun Date: Wed, 27 May 2026 02:30:45 -0700 Subject: [PATCH] fix: run api container as non-root dograh user (#360) * fix: run api container as non-root dograh user The runner stage had no USER directive, causing the API process to run as root inside the container. Add a system user/group and transfer ownership of /app before switching to it, so the container process runs with minimal privileges. * fix: chown /app and use COPY --chown for non-root runner Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Abhishek Kumar Co-authored-by: Claude Opus 4.7 (1M context) --- api/Dockerfile | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/api/Dockerfile b/api/Dockerfile index f764d86..85c5f56 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -71,6 +71,10 @@ FROM python:3.13-slim AS runner WORKDIR /app +RUN groupadd --system dograh \ + && useradd --system --gid dograh --no-log-init --home-dir /app --shell /usr/sbin/nologin dograh \ + && chown dograh:dograh /app + # Static ffmpeg + ffprobe (used by audio_converter, audio_file_cache, etc.) COPY --from=ffmpeg-static /usr/local/bin/ffmpeg /usr/local/bin/ffmpeg COPY --from=ffmpeg-static /usr/local/bin/ffprobe /usr/local/bin/ffprobe @@ -93,23 +97,26 @@ ENV PYTHONDONTWRITEBYTECODE=1 # Unbuffered output for better container logging ENV PYTHONUNBUFFERED=1 -# Copy application code -COPY ./api ./api -COPY ./scripts/start_services_docker.sh ./scripts/start_services_docker.sh +# Copy application code (chown at copy-time avoids a duplicate /app layer +# from a later `RUN chown -R`, which would double the on-disk size of /app). +COPY --chown=dograh:dograh ./api ./api +COPY --chown=dograh:dograh ./scripts/start_services_docker.sh ./scripts/start_services_docker.sh # ts_validator Node deps (built in ts-deps stage with full node:22-slim image). # The validator runs as a short-lived subprocess from api/mcp_server/ts_bridge.py. -COPY --from=ts-deps /ts_validator/node_modules ./api/mcp_server/ts_validator/node_modules +COPY --from=ts-deps --chown=dograh:dograh /ts_validator/node_modules ./api/mcp_server/ts_validator/node_modules # Product documentation — read at runtime by the MCP docs tools # (search_dograh_docs / fetch_dograh_doc) so agents can learn Dograh. -COPY ./docs ./docs +COPY --chown=dograh:dograh ./docs ./docs ENV PYTHONPATH=/app # Disable file logging in Docker - logs go to stdout for docker logs ENV LOG_TO_FILE=false +USER dograh + # Expose the port FastAPI will run on EXPOSE 8000