starred/webmail
1
0
Fork 0
mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-30 16:16:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: keep the app files in the Docker image read-only for the user it runs as

Browse Source
This commit is contained in:
Linus Rath
2026-10-26 14:52:04 +01:00
parent eb2787bcc9
commit 72faa57367
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+7 -3
View File
@@ -50,10 +50,14 @@ RUN apk upgrade --no-cache && \
rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npx && \
addgroup --system --gid 1001 nodejs && \
adduser --system --uid 1001 nextjs
# The app stays root's and read-only for the runtime user, so a bug that
# lets it write a file can't replace server.js or a bundle and run code on
# the next start. It writes only to Next's cache and the data dirs.
COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
RUN mkdir -p /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && chown -R nextjs:nodejs /app/data
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static
RUN mkdir -p /app/.next/cache /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && \
chown -R nextjs:nodejs /app/.next/cache /app/data
USER nextjs
EXPOSE 3000
ENV PORT=3000