From a2a9fda6c7fb230d24cee4ee6230c3b5a0caf543 Mon Sep 17 00:00:00 2001 From: nogueiraguh Date: Mon, 23 Mar 2026 15:25:54 -0300 Subject: [PATCH] =?UTF-8?q?fix:=20remove=20gosu=20(Go=201.24.4=20CVEs)=20?= =?UTF-8?q?=E2=80=94=20use=20runuser=20instead,=20CRITICAL=204=E2=86=923,?= =?UTF-8?q?=20HIGH=2012=E2=86=925?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/Dockerfile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index d245f9a..888e429 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -30,10 +30,9 @@ RUN groupadd -r agent && useradd -r -g agent -d /app -s /bin/bash agent && \ # Generate OCI Terraform resource reference at build time RUN python gen_tf_reference.py || echo "WARN: tf reference generation skipped (terraform init may need network)" -# Entrypoint: fix /data ownership then exec as agent user -RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec gosu agent "$@"\n' > /entrypoint.sh && \ - chmod +x /entrypoint.sh && \ - apt-get update && apt-get install -y --no-install-recommends gosu && rm -rf /var/lib/apt/lists/* +# Entrypoint: fix /data ownership then drop to agent user (no gosu needed) +RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec runuser -u agent -- "$@"\n' > /entrypoint.sh && \ + chmod +x /entrypoint.sh VOLUME /data ENTRYPOINT ["/entrypoint.sh"]