Update the docker file of the front-end app with nginx light wieght s… - #41
Update the docker file of the front-end app with nginx light wieght s…#41Umar-Devops-cyber wants to merge 1 commit into
Conversation
…erver using multistage build
📝 WalkthroughWalkthroughThe frontend ChangesFrontend Dockerfile Multi-Stage Build
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Application-Code/frontend/Dockerfile`:
- Around line 27-36: The runtime stage Dockerfile is running Nginx as the root
user by default, creating a security vulnerability. Add a USER directive in the
Dockerfile after the COPY instruction and before the CMD instruction to run
Nginx as a non-root user. Use a non-privileged user that exists in the
nginx:1.27-alpine image, such as the nginx user, to ensure the container runs
with reduced privileges and improved isolation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5ebee14d-324a-4105-bc7e-736babde17e3
📒 Files selected for processing (1)
Application-Code/frontend/Dockerfile
| FROM nginx:1.27-alpine | ||
|
|
||
| # Copy built static files from the build stage into Nginx's serving directory | ||
| COPY --from=build /app/build /usr/share/nginx/html | ||
|
|
||
| # Expose the port Nginx listens on | ||
| EXPOSE 80 | ||
|
|
||
| # Run Nginx in the foreground (required for Docker containers) | ||
| CMD ["nginx", "-g", "daemon off;"] |
There was a problem hiding this comment.
Run Nginx as a non-root user in the runtime stage.
Line 27+ currently uses an image/config that runs as root by default, and there is no USER override. This weakens container isolation and matches the DS-0002 finding.
Suggested hardening patch
-FROM nginx:1.27-alpine
+FROM nginxinc/nginx-unprivileged:1.27-alpine
# Copy built static files from the build stage into Nginx's serving directory
COPY --from=build /app/build /usr/share/nginx/html
-# Expose the port Nginx listens on
-EXPOSE 80
+# Unprivileged nginx listens on 8080 by default
+EXPOSE 8080
# Run Nginx in the foreground (required for Docker containers)
CMD ["nginx", "-g", "daemon off;"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Application-Code/frontend/Dockerfile` around lines 27 - 36, The runtime stage
Dockerfile is running Nginx as the root user by default, creating a security
vulnerability. Add a USER directive in the Dockerfile after the COPY instruction
and before the CMD instruction to run Nginx as a non-root user. Use a
non-privileged user that exists in the nginx:1.27-alpine image, such as the
nginx user, to ensure the container runs with reduced privileges and improved
isolation.
Source: Linters/SAST tools
1 participant
…erver using multistage build
Summary by CodeRabbit