fix(docker): run the test image as a non-root user

.github/workflows/docksec.yml

@@ -5,10 +5,12 @@ on:
     branches: [master]
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   pull_request:
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   schedule:
     - cron: '0 6 * * 1'

Dockerfile

@@ -1,33 +1,34 @@
 ARG PYTHON_VERSION=3.10
 FROM python:${PYTHON_VERSION}-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libsodium23 \
-    wget \
-    build-essential \
-    libffi-dev \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
+
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
-ENV PIP_NO_CACHE_DIR=false \
-    PIP_DISABLE_PIP_VERSION_CHECK=on \
+ENV PIP_DISABLE_PIP_VERSION_CHECK=on \
     PIP_DEFAULT_TIMEOUT=10 \
     PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1
 
-RUN pip install uv
+USER 10001
 
-COPY pyproject.toml uv.lock* README.md /app/
+COPY --chown=app:app pyproject.toml uv.lock* README.md /app/
 
 RUN uv sync --extra dev
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY tornadoapi_guard/ /app/tornadoapi_guard/
-COPY tests/ /app/tests/
-COPY examples/ /app/examples/
-COPY docs/ /app/docs/
+COPY --chown=app:app tornadoapi_guard/ /app/tornadoapi_guard/
+COPY --chown=app:app tests/ /app/tests/
+COPY --chown=app:app examples/ /app/examples/
+COPY --chown=app:app docs/ /app/docs/
 
 RUN mkdir -p /app/data/ipinfo
+
+# Probes the app service on port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]

compose.yml

@@ -29,6 +29,8 @@ services:
           PYTHON_VERSION: ${PYTHON_VERSION:-3.10}
       image: tornadoapi-guard-py${PYTHON_VERSION:-3.10}
       command: pytest -v --cov=.
+      healthcheck:
+        disable: true
       environment:
         - REDIS_URL=redis://redis:6379
         - REDIS_PREFIX=${REDIS_PREFIX:-"test:tornadoapi_guard:"}

examples/simple_app/Dockerfile

@@ -1,13 +1,9 @@
 ARG PYTHON_VERSION=3.10
 FROM python:${PYTHON_VERSION}-slim
 
-RUN apt-get update && apt-get install -y \
-    libsodium23 \
-    wget \
-    build-essential \
-    libffi-dev \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
@@ -21,10 +17,16 @@ COPY requirements.txt /app/
 
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . /app/
+USER 10001
+
+COPY --chown=app:app . /app/
 
 RUN mkdir -p /app/data/ipinfo
 
 EXPOSE 8000
 
+# Probes port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]
+
 CMD ["python", "main.py"]