Merge pull request #12 from esune/fix/image-permissions

Fix permissions in service image, added .dockerignore
bcgov · Oct 22, 2024 · f14d721 · f14d721
2 parents fe66e2a + 55050d6
commit f14d721
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,4 @@
+.devcontainer
+.github
+.vscode
+docker
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -1,7 +1,14 @@
-FROM python:3.12
+FROM python:3.12-slim
+
+# Create unprivileged user and group for service
+RUN addgroup vcservice
+RUN useradd -g vcservice vcservice
 
 WORKDIR /app
 
+# make user owner of app folder
+RUN chown -R vcservice:vcservice /app
+
 RUN pip install --no-cache-dir --upgrade pip
 RUN pip install poetry
 
@@ -12,4 +19,6 @@ RUN poetry install --no-root --only main
 
 COPY ../ ./
 
+USER vcservice
+
 CMD ["fastapi", "run", "main.py", "--port", "8080", "--proxy-headers"]