From 1820cd408d8390b24d6814d48c3ec394ec931f62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20BUISSON?= Date: Wed, 8 Jul 2026 09:50:08 +0200 Subject: [PATCH] chore(security): run image as non-root and disable CI checkout credential persistence --- .github/workflows/documentation.yml | 1 + .github/workflows/pull_request.yml | 1 + Dockerfile | 2 ++ tmpl.Dockerfile | 2 ++ 4 files changed, 6 insertions(+) diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 915da999..8f7a3571 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -22,6 +22,7 @@ jobs: uses: actions/checkout@v2 with: fetch-depth: 0 + persist-credentials: false - name: Login to DockerHub uses: docker/login-action@v1 diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index f38018bf..8d5804ab 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -15,6 +15,7 @@ jobs: uses: actions/checkout@v2 with: fetch-depth: 0 + persist-credentials: false - name: Package documentation run: make docs-package diff --git a/Dockerfile b/Dockerfile index 1ace60ed..72e7cccb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -43,4 +43,6 @@ RUN addgroup -g 1000 -S app && \ COPY --from=base-image /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=maker /go/src/github.com/traefik/mesh/dist/traefik-mesh /app/ +USER app + ENTRYPOINT ["/app/traefik-mesh"] diff --git a/tmpl.Dockerfile b/tmpl.Dockerfile index 40dff83e..52294429 100644 --- a/tmpl.Dockerfile +++ b/tmpl.Dockerfile @@ -36,4 +36,6 @@ RUN addgroup -g 1000 -S app && \ COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=builder /go/src/github.com/traefik/mesh/dist/traefik-mesh /app/ +USER app + ENTRYPOINT ["/app/traefik-mesh"]