fix(docker): run the test image as a non-root user

.github/workflows/docksec.yml

@@ -5,10 +5,12 @@ on:
     branches: [master]
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   pull_request:
     paths:
       - 'Dockerfile'
+      - '**/Dockerfile'
       - '.github/workflows/docksec.yml'
   schedule:
     - cron: '0 6 * * 1'

Dockerfile

@@ -1,32 +1,33 @@
 ARG PYTHON_VERSION=3.10
 FROM python:${PYTHON_VERSION}-slim
 
-RUN apt-get update && apt-get install -y \
-    libsodium23 \
-    wget \
-    build-essential \
-    libffi-dev \
-    curl
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
+
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
-ENV PIP_NO_CACHE_DIR=false \
-    PIP_DISABLE_PIP_VERSION_CHECK=on \
+ENV PIP_DISABLE_PIP_VERSION_CHECK=on \
     PIP_DEFAULT_TIMEOUT=10 \
     PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1
 
-# Install uv
-RUN pip install uv
+USER 10001
 
-COPY pyproject.toml uv.lock* README.md /app/
+COPY --chown=app:app pyproject.toml uv.lock* README.md /app/
 
 RUN uv sync --extra dev
 
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY djangoapi_guard/ /app/djangoapi_guard/
-COPY tests/ /app/tests/
-COPY examples/ /app/examples/
+COPY --chown=app:app djangoapi_guard/ /app/djangoapi_guard/
+COPY --chown=app:app tests/ /app/tests/
+COPY --chown=app:app examples/ /app/examples/
 
 RUN mkdir -p /app/data/ipinfo
+
+# Probes the app service on port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]

compose.yml

@@ -27,6 +27,8 @@ services:
           PYTHON_VERSION: ${PYTHON_VERSION:-3.10}
       image: djapi-guard-py${PYTHON_VERSION:-3.10}
       command: pytest -v --cov=.
+      healthcheck:
+        disable: true
       environment:
         - REDIS_URL=redis://redis:6379
         - REDIS_PREFIX=${REDIS_PREFIX:-"test:djangoapi_guard:"}

examples/advanced/Dockerfile

@@ -18,7 +18,7 @@ RUN uv venv .venv && \
 FROM python:3.12-slim
 
 RUN groupadd --system guard && \
-    useradd --system --gid guard --create-home guard
+    useradd --system --uid 10001 --gid guard --create-home guard
 
 WORKDIR /app
 
@@ -33,8 +33,12 @@ ENV PATH="/app/.venv/bin:$PATH" \
     PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1
 
-USER guard
+USER 10001
 
 EXPOSE 8000
 
+# Same probe as the compose services: /health must answer 2xx.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3)"]
+
 CMD ["gunicorn", "-c", "gunicorn.conf.py", "advanced_project.wsgi:application"]

examples/simple/Dockerfile

@@ -1,17 +1,22 @@
 FROM python:3.12-slim
 
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    libffi-dev \
-    && rm -rf /var/lib/apt/lists/*
+RUN useradd --create-home --uid 10001 app \
+    && mkdir /app \
+    && chown app:app /app
 
 WORKDIR /app
 
 COPY requirements.txt /app/
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . /app/
+USER 10001
+
+COPY --chown=app:app . /app/
 
 EXPOSE 8000
 
+# Probes port 8000. Any HTTP answer counts as alive; a refused connection or a timeout fails.
+HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "-c", "import urllib.request, urllib.error\ntry:\n    urllib.request.urlopen('http://127.0.0.1:8000/', timeout=3)\nexcept urllib.error.HTTPError:\n    pass"]
+
 CMD ["gunicorn", "example_project.wsgi:application", "--bind", "0.0.0.0:8000", "--reload"]