Security: Run container as non-root user (UID 10001) #100

New Issue

MrUnknownDE · 2026-04-05T16:16:31+02:00

MrUnknownDE commented

2026-04-05 16:16:31 +02:00

Originally created by @sbaerlocher on 11/12/2025

Summary

Configure Docker container to run as non-root user app (UID 10001) instead of root.

Changes

Create non-root user with high UID (10001) in Dockerfile
Set proper ownership for application files and pnpm cache
Switch to non-root user before container starts

Benefits

Prevents host UID collisions
Reduces attack surface if container is compromised
Meets Kubernetes runAsNonRoot security policies
Follows Docker security best practices

Test

$ docker compose exec open-archiver id
uid=10001(app) gid=10001(app)

*Originally created by @sbaerlocher on 11/12/2025* ## Summary Configure Docker container to run as non-root user `app` (UID 10001) instead of root. ## Changes - Create non-root user with high UID (10001) in Dockerfile - Set proper ownership for application files and pnpm cache - Switch to non-root user before container starts ## Benefits - Prevents host UID collisions - Reduces attack surface if container is compromised - Meets Kubernetes runAsNonRoot security policies - Follows Docker security best practices ## Test ```bash $ docker compose exec open-archiver id uid=10001(app) gid=10001(app) ```

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/OpenArchiver#100