github-starred/awesome-compose
2
0
Fork 0
mirror of https://github.com/docker/awesome-compose.git synced 2026-07-16 13:21:57 -05:00
Code Issues 9.3k Packages Projects Releases Wiki Activity

[GH-ISSUE #752] Security Hardening: Enforce non-root execution (USER) in example Dockerfiles #15521

New Issue
Closed
opened 2026-06-21 01:19:08 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-06-21 01:19:08 -05:00
Owner
Copy Link

Originally created by @BiosSystem on GitHub (May 30, 2026).
Original GitHub issue: https://github.com/docker/awesome-compose/issues/752

Problem Description

Several Dockerfile examples in the repository do not declare a USER directive. Consequently, the containers run under the default privileged root user context. Standard security benchmarks (such as Hadolint and Docker production-grade hardening guidelines) recommend running container processes as non-root users to mitigate potential security vulnerabilities and limit privilege escalation risk in the event of a container escape.

Affected Examples

  1. vuejs (vuejs/vuejs/Dockerfile)
    • At line 22, a non-root user vscode is created (adduser -S --shell /bin/bash --ingroup docker vscode), but USER vscode is never set, leaving the container execution context as root.
  2. wasmedge-kafka-mysql (wasmedge-kafka-mysql/etl/Dockerfile)
    • The final scratch base container lacks a USER instruction, defaulting execution to root (UID 0) in standard container runtimes.
  3. wasmedge-mysql-nginx (wasmedge-mysql-nginx/backend/Dockerfile)
    • Runs as root without declaring a non-root execution boundary.

Proposed Remediations

  1. For vuejs/vuejs/Dockerfile, add USER vscode after creating the user: 
    RUN <<EOF
addgroup -S docker
adduser -S --shell /bin/bash --ingroup docker vscode
EOF
USER vscode
  2. For scratch base images, declare a non-privileged UID: 
    FROM scratch
USER 10001
COPY --link --from=build /kafka.wasm /kafka.wasm
ENTRYPOINT [ "kafka.wasm" ]
Originally created by @BiosSystem on GitHub (May 30, 2026). Original GitHub issue: https://github.com/docker/awesome-compose/issues/752 ### Problem Description Several Dockerfile examples in the repository do not declare a `USER` directive. Consequently, the containers run under the default privileged `root` user context. Standard security benchmarks (such as Hadolint and Docker production-grade hardening guidelines) recommend running container processes as non-root users to mitigate potential security vulnerabilities and limit privilege escalation risk in the event of a container escape. ### Affected Examples 1. **`vuejs`** (`vuejs/vuejs/Dockerfile`) - At line 22, a non-root user `vscode` is created (`adduser -S --shell /bin/bash --ingroup docker vscode`), but `USER vscode` is never set, leaving the container execution context as root. 2. **`wasmedge-kafka-mysql`** (`wasmedge-kafka-mysql/etl/Dockerfile`) - The final `scratch` base container lacks a `USER` instruction, defaulting execution to root (UID 0) in standard container runtimes. 3. **`wasmedge-mysql-nginx`** (`wasmedge-mysql-nginx/backend/Dockerfile`) - Runs as root without declaring a non-root execution boundary. ### Proposed Remediations 1. For **`vuejs/vuejs/Dockerfile`**, add `USER vscode` after creating the user: ```dockerfile RUN <<EOF addgroup -S docker adduser -S --shell /bin/bash --ingroup docker vscode EOF USER vscode ``` 2. For **`scratch`** base images, declare a non-privileged UID: ```dockerfile FROM scratch USER 10001 COPY --link --from=build /kafka.wasm /kafka.wasm ENTRYPOINT [ "kafka.wasm" ] ```
GiteaMirror commented 2026-06-21 01:19:10 -05:00
Author
Owner
Copy Link

@BiosSystem commented on GitHub (May 30, 2026):

Closing as this issue targets example files.

<!-- gh-comment-id:4582562155 --> @BiosSystem commented on GitHub (May 30, 2026): Closing as this issue targets example files.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
good first issue
proposal
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/awesome-compose#15521
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?