finnandClaude Opus 5.5
931243dd60
The app ran as root, and the production image contained gcc, vim, wget and gnupg. Code execution in the container would have allowed changing the app code and fetching or compiling further tools. - Multi-stage build: the wheels (psycopg2) are built in a build stage. The runtime image only contains libpq5, postgresql-client and wait-for-it (724 MB -> 298 MB). - The app runs as the system user max (uid/gid 10001). The code is owned by root and precompiled, the user has no writable directory. - Log to stdout only; docker collects it. The log file under /app/log was lost on every container recreation anyway. - docker-compose: read-only filesystem (tmpfs for /tmp), no capabilities, no-new-privileges and log rotation (5 x 10 MB). - Add a .dockerignore and set MAX_ORIGIN in docker-compose.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 lines
68 B
Plaintext
9 lines
68 B
Plaintext
.git
|
|
.devcontainer
|
|
.vscode
|
|
.claude
|
|
docs
|
|
log
|
|
**/__pycache__
|
|
**/*.pyc
|