Skip to content

fix: run the dev container as non-root #39

Closed
Closed
fix: run the dev container as non-root#39
Labels
security
Milestone
1.6.0

Description

@WhiteMuush
WhiteMuush
opened on Oct 13, 2026

Finding

Trivy (DS-0002, HIGH): Dockerfile.dev has no USER instruction, so the development container runs as root. The production Dockerfile already runs as an unprivileged user.

Expected

The dev image runs as a non-root user, with the bind-mounted source still writable.

Activity

  1. WhiteMuush
    added this to the 1.6.0 milestone on Oct 13, 2026
  2. WhiteMuush
    added
    security
    on Oct 13, 2026
  3. WhiteMuush
    added this to Gardik Roadmapon Oct 13, 2026
  4. WhiteMuush
    moved this to Todo in Gardik Roadmapon Oct 13, 2026
  5. WhiteMuush
    moved this from Todo to In Progress in Gardik Roadmapon Oct 13, 2026

  6. WhiteMuush commented on Oct 13, 2026

    @WhiteMuush
    WhiteMuush
    on Oct 13, 2026
    OwnerAuthor

    Shipped in #45 (merged into develop).

  7. WhiteMuush
    closed this as completedon Oct 13, 2026
  8. github-project-automation
    moved this from In Progress to Done in Gardik Roadmapon Oct 13, 2026
  9. WhiteMuush
    moved this from In Progress to Done in Gardik Roadmapon Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions