finnandClaude Opus 5.5
931243dd60
The app ran as root, and the production image contained gcc, vim, wget and gnupg. Code execution in the container would have allowed changing the app code and fetching or compiling further tools. - Multi-stage build: the wheels (psycopg2) are built in a build stage. The runtime image only contains libpq5, postgresql-client and wait-for-it (724 MB -> 298 MB). - The app runs as the system user max (uid/gid 10001). The code is owned by root and precompiled, the user has no writable directory. - Log to stdout only; docker collects it. The log file under /app/log was lost on every container recreation anyway. - docker-compose: read-only filesystem (tmpfs for /tmp), no capabilities, no-new-privileges and log rotation (5 x 10 MB). - Add a .dockerignore and set MAX_ORIGIN in docker-compose.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st