Skip to content

Conversation

@joseluisq
Copy link
Collaborator

@joseluisq joseluisq commented Sep 26, 2025

Description

This PR makes the current Debian and Alpine Docker images rootless by default using a dedicated user and group. This reduces the attack surface and improves security.

Remember: users can still run the containers as root if they explicitly set the user to root when running the container, e.g., using the --user root flag with docker run.

The static-web-server binary and all files in the /home/sws (home directory) are owned by the non-root user/group called sws, and the current working directory is the home directory.

For convenience, those paths are also available:

  • Public directory: /home/sws/public
  • Public directory symlink: /var/public -> /home/sws/public

Related Issue

Motivation and Context

Reduce the attack surface and enhance the security of existing Docker images.

How Has This Been Tested?

Screenshots (if appropriate):

@semanticdiff-com
Copy link

Review changes with  SemanticDiff

@joseluisq joseluisq added enhancement New feature or request v2 v2 release security Related to Security docker Related to Docker environment or images labels Nov 4, 2025
@joseluisq joseluisq self-assigned this Nov 4, 2025
@joseluisq joseluisq changed the title Rootless Docker image support Rootless Debian and Alpine Docker images support Nov 17, 2025
@joseluisq joseluisq marked this pull request as ready for review November 17, 2025 21:20
@joseluisq joseluisq changed the title Rootless Debian and Alpine Docker images support Rootless Debian and Alpine Docker images by default Nov 17, 2025
@joseluisq joseluisq merged commit b234984 into master Nov 17, 2025
34 checks passed
@joseluisq joseluisq deleted the docker-rootless-variant branch November 17, 2025 22:22
@joseluisq joseluisq added this to the v2.40.0 milestone Nov 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docker Related to Docker environment or images enhancement New feature or request security Related to Security v2 v2 release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants