[PR #1533] [CLOSED] refac: non-privileged Dockerfile #7493

New Issue

GiteaMirror · 2025-11-11T17:28:13-06:00

GiteaMirror commented

2025-11-11 17:28:13 -06:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/1533
Author: @ghost
Created: 4/13/2024
Status: ❌ Closed

Base: dev ← Head: dockerfile-non-root

📝 Commits (1)

8d22dae refac: non-root Dockerfile

📊 Changes

2 files changed (+29 additions, -13 deletions)

View changed files

📝 Dockerfile (+29 -8)
📝 backend/start.sh (+0 -5)

📄 Description

Pull Request Checklist

Description: Briefly describe the changes in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation?

Description

Follow Docker best practices: update Dockerfile to run as a non-root user. This reduces the potential attack surface and follows the Docker security recommendation. See:

https://docs.docker.com/engine/security/#conclusions
https://docs.docker.com/develop/develop-images/instructions/#user

Basic testing succeeds, standard and builds with --build-arg="USE_CUDA=true" --build-arg"USE_OLLAMA=true" function as expected.

Important

This changes the effective numeric user ID and group ID of the container user. All existing data volumes must be updated accordingly, for example: docker run --rm -u root -v open-webui:/app/backend/data -it open-webui chown -Rv open-webui:open-webui /app/backend/

Changelog Entry

Added

Add ARGs for new system open-webui user/group UID & GID.
Use USER instruction where possible to complete the build as limited user.
Set ENV PATH= and execute chown & COPY with --chown as required.

Fixed

Security improvement.

Changed

Move LD_LIBRARY_PATH= required for CUDA to Dockerfile using ENV LD_LIBRARY_PATH=.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/1533 **Author:** [@ghost](https://github.com/ghost) **Created:** 4/13/2024 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `dockerfile-non-root` --- ### 📝 Commits (1) - [`8d22dae`](https://github.com/open-webui/open-webui/commit/8d22daea6c11921ae0604aab72727758198029a0) refac: non-root Dockerfile ### 📊 Changes **2 files changed** (+29 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `Dockerfile` (+29 -8) 📝 `backend/start.sh` (+0 -5) </details> ### 📄 Description ## Pull Request Checklist - [x] **Description:** Briefly describe the changes in this pull request. - [x] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [ ] **Documentation:** Have you updated relevant documentation? --- ## Description Follow Docker best practices: update Dockerfile to run as a non-root user. This reduces the potential attack surface and follows the Docker security recommendation. See: https://docs.docker.com/engine/security/#conclusions https://docs.docker.com/develop/develop-images/instructions/#user Basic testing succeeds, standard and builds with `--build-arg="USE_CUDA=true"` `--build-arg"USE_OLLAMA=true"` function as expected. > [!IMPORTANT] > This changes the effective numeric user ID and group ID of the container user. All existing data volumes must be updated accordingly, for example: `docker run --rm -u root -v open-webui:/app/backend/data -it open-webui chown -Rv open-webui:open-webui /app/backend/` --- ### Changelog Entry ### Added - Add `ARG`s for new system **_open-webui_** user/group UID & GID. - Use `USER` instruction where possible to complete the build as limited user. - Set `ENV PATH=` and execute `chown` & `COPY` with `--chown` as required. ### Fixed - Security improvement. ### Changed - Move `LD_LIBRARY_PATH=` required for CUDA to Dockerfile using `ENV LD_LIBRARY_PATH=`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-11 17:28:13 -06:00

GiteaMirror closed this issue

2025-11-11 17:28:13 -06:00

GiteaMirror referenced this issue

2025-11-11 18:08:11 -06:00

[PR #7493] [MERGED] feat: Feature to set HTTP header "Content-Security-Policy" #8865

Sign in to join this conversation.