chore(security): harden remaining PROD-5198 Dockerfiles

[plural-copilot]

Scope

• Run documentation, console build, Kubernetes-agent, flaky-service, and flaky sidecar images as non-root where safe; preserve required writable application paths.
• Add real HTTP health checks for documentation (/ on 3000), deployment-operator (/readyz on 9001), and flaky-service (/metrics on 8081).
• Use explicit HEALTHCHECK NONE only for finite build, scratch/distroless/Wolfi, reverse-tunnel, or listener-less sidecar images where an in-image probe client/endpoint is not available.
• Pin the previously floating cloud-query Wolfi and flaky-service Alpine bases to immutable multi-architecture digests.
• Add apt --no-install-recommends and consolidate Softserve APK update/upgrade/install layers.

Deliberately excluded / dependency findings

• Did not duplicate PR fix(deps): remediate PROD-5214 dependency alerts #4375: its x/crypto 0.55.0→0.56.0, decode-uri-component→0.5.0, and documentation Mermaid→11.16.1 changes are excluded.
• qs is already resolved to 6.16.0 in js/yarn.lock; js/console/package.json has no direct qs dependency. No lockfile change or regeneration was applicable.
• The PR chore(deps): remediate PROD-5213 vulnerabilities #4326 findings are already at the reported remediated versions on master: gRPC 1.83.2, fast-uri 3.1.6, immutable 3.8.4, lodash/lodash-es 4.18.1, and js-yaml 4.3.2. No dependency update was repeated.

Safe non-applicable findings

• dockerfiles/Dockerfile.test remains root because docker-compose.test.yml bind-mounts the host checkout at /app and the test workflow writes artifacts there; a fixed image UID would break CI/workstation checkout ownership.
• Scratch/distroless/Wolfi images do not contain a shell or HTTP client for a Docker health check. Kubernetes retains its real endpoint probes (/healthz, /health, /readiness, /liveness) instead of adding unavailable binaries.

Validation

• Passed: git diff --check
• Passed: Node Dockerfile policy assertion script for USER, HEALTHCHECK/endpoint, immutable FROM, apt, and APK directives.
• Passed: Docker runtime inspection of Alpine/Node non-root users and BusyBox wget availability.
• Attempted: docker build -t prod5198-flaky -f go/demo/flaky-service/Dockerfile go/demo/flaky-service; docker build -t prod5198-sidecar -f go/demo/flaky-service/Dockerfile.sidecar go/demo/flaky-service; node .yarn/releases/yarn-4.17.1.cjs install --immutable. Each began successfully but the agent harness terminated during external image/package fetches before completion. Full builds remain CI validation.

Fixes PROD-5198

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one reviewable PR implementing the remaining safe remediation for Linear PROD-5198. Work only in this repository. Do not duplicate or compete with the already-open remediation PR #4375: it covers x/crypto 0.55.0→0.56.0 in several modules, decode-uri-component→0.5.0, and documentation Mermaid→11.16.1. Inspect its diff/current target state as needed and exclude that work....
🔗 Run history	View run history

[linear]

PROD-5198

[soffi-ai]

Soffi AI Summary

This PR hardens the security posture of remaining Dockerfiles across the monorepo as part of the PROD-5198 initiative. The changes address several categories of risk:

1. Non-root execution: The flaky-service, flaky sidecar, documentation, console build, and Kubernetes-agent images now create and switch to a dedicated non-root user (app, node, or nonroot), reducing the blast radius of container escapes.

2. Explicit health checks: Real HTTP health checks are added where a probe client and listener are available — documentation (/ on port 3000), deployment-operator (/readyz on port 9001), and flaky-service (/metrics on port 8081) — using BusyBox wget. Images that are finite build stages, scratch/distroless/Wolfi-based, or listener-less (reverse-tunnel sidecar, API-only sidecar) receive explicit HEALTHCHECK NONE to make the intent clear and avoid inheriting an undefined default.

3. Pinned base image digests: The previously floating alpine:latest (flaky-service) and cgr.dev/chainguard/wolfi-base (cloud-query) base images are pinned to immutable multi-architecture SHA256 digests, preventing supply-chain drift.

4. Consolidated and hardened APK/APT layers: The Softserve Dockerfiles consolidate multiple apk update / apk add / apk upgrade invocations into single chained RUN steps to reduce image layers and ensure security upgrades are applied atomically. The test Dockerfile adds --no-install-recommends to its Debian apt-get install call to minimize the installed surface.

5. Correct working directory ownership: The documentation and console build images explicitly chown the working directory to the non-root user before switching, ensuring writable runtime caches (Next.js) and build outputs remain accessible after the USER directive takes effect.

Changes

Dockerfile non-root, health check, and base image hardening

• Hardened all remaining production Dockerfiles per PROD-5198: switched flaky-service, flaky sidecar, documentation, console build, and Kubernetes-agent images to non-root users; added real HTTP health checks for services that expose a probe endpoint (deployment-operator /readyz, flaky-service /metrics, documentation /); added explicit HEALTHCHECK NONE for scratch/distroless/Wolfi/build-only images; pinned alpine:latest and wolfi-base to immutable SHA256 digests; consolidated Softserve APK layers into single chained RUN steps; and added --no-install-recommends to the test Dockerfile's apt-get call. (6382392)

---

Updated: 2026-09-22 18:47 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the new users, writable paths, probe endpoints, and package-install changes are consistent with the affected container runtimes.

Summary

This PR hardens eleven Dockerfiles by reducing runtime privileges, adding service-appropriate health checks, pinning selected runtime bases, and tightening package installation.

• Runs the documentation server, Console asset build, Kubernetes-agent images, and flaky demo containers as non-root.
• Adds HTTP health checks for documentation, deployment-operator, and flaky-service.
• Explicitly disables in-image checks where the image is finite, listener-less, or lacks a probe client.
• Pins Cloud Query and flaky-service runtime images and consolidates package-manager operations.
• No actionable correctness, security, or repository-rule violations were identified.

_{Reviews (1) · Last reviewed commit: "chore(security): harden service Dockerfi..."}