Dockerfile best practices #3

New Issue

florian · 2024-01-12T20:05:21+01:00

florian commented

2024-01-12 20:05:21 +01:00

The Dockerfile, albeit working has a few issues we should address, either for security, consistency or just for brownie points.

Security

We should add a non-root user to the Dockerfile and run the binary with the permissions of that user.
While not strictly speaking an issue now, we should use good practices from the beginning and copy files into the stages and between the stages explicitly instead of just plainly copying everything around with COPY . ..

This also has the brownie points benefit of allowing better caching later down the line I think.

Consistency

Our native binaries are named gitea-account-bot-$VERSION-$ARCH. So there is no reason why would be diverging from that within the Docker images.

⚠️ This is a breaking change for users who are using the Docker image with a custom commandline and
explicitly refer to the executable directly.

The Dockerfile, albeit working has a few issues we should address, either for security, consistency or just for brownie points. ### Security * We should add a non-root user to the Dockerfile and run the binary with the permissions of that user. * While not strictly speaking an issue now, we should use good practices from the beginning and copy files into the stages and between the stages explicitly instead of just plainly copying everything around with `COPY . .`. This also has the brownie points benefit of allowing better caching later down the line I think. ### Consistency * Our native binaries are named `gitea-account-bot-$VERSION-$ARCH`. So there is no reason why would be diverging from that within the Docker images. ⚠️ **This is a breaking change for users who are using the Docker image with a custom commandline and explicitly refer to the executable directly.**

florian added the

labels 2024-01-12 20:05:21 +01:00

florian self-assigned this 2024-01-12 20:05:21 +01:00

florian added reference main

2024-01-12 20:05:39 +01:00

florian referenced this issue from a commit

2024-01-12 20:13:57 +01:00