[rennf93]

The two Dockerfiles in this repo now follow the standard of the adapters' root Dockerfiles, and DockSec scans them.

Root Dockerfile (the test image):

1. The apt block (libsodium23, wget, build-essential, libffi-dev, curl) is gone. I built the image and ran the suite without it and nothing needed it, so there is nothing to pin.
2. pip install uv became COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/, and PIP_NO_CACHE_DIR=false is gone.
3. User app (uid 10001) owns /app, USER 10001 comes before uv sync. It still runs uv sync --extra dev without --frozen, as since fix(docker): make the compose test path pass without a lockfile or a localhost Redis #89.
4. HEALTHCHECK is python -c "import guard_agent": the image is a one-shot test runner with no service to probe. compose.yml sets healthcheck: disable: true on the test service.

examples/demo_app/Dockerfile (the image container-release.yml publishes to ghcr): numeric uid 10001 for the existing guard user, USER 10001, and a HEALTHCHECK on /health, which the app serves. DockSec runs trivy config over the whole tree, so this file raised DS026 and had to be fixed for the scan to be clean.

.github/workflows/docksec.yml is copied from fastapi-guard master: same pinned OWASP/DockSec SHA, same pinned upload-sarif, push and pull_request paths including '**/Dockerfile', category docksec, fork-PR guard on the upload.

Verification (compose test service, own compose project, Redis without a host port, one run at a time, master vs this branch, with the CI flags pytest -v --cov=guard_agent --cov-fail-under=100):

• Python 3.10: master 545 passed, 2 skipped; branch 545 passed, 2 skipped; coverage 100.00% on both.
• Python 3.14: master 545 passed, 2 skipped; branch 545 passed, 2 skipped; coverage 100.00% on both.
• Demo image built the way container-release.yml builds it (docker build -f examples/demo_app/Dockerfile .) and run: healthy, uid=10001, GET /health 200. The log shows 401 from the ingestion endpoint because the demo has no API key, as before.
• hadolint 2.15.1 on both Dockerfiles: no output. On master the root one had DL3008, DL3009, DL3015, DL3013 and DL3042.
• trivy 0.74.0 config --file-patterns dockerfile:Dockerfile over the repo: 27 successes, 0 failures for both Dockerfiles (master: DS026 on the demo, which I fixed here).
• DockSec check on this PR: pass. Analysis on refs/pull/90/merge (commit 1e12216): results_count 0.

Not verified: Python versions other than 3.10 and 3.14, and the CI result beyond the checks listed on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.