appuser shouldn't be able to modify app files

actualbudget · Jan 16, 2024 · 2159c87 · 2159c87
1 parent 8dddd84
commit 2159c87
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 22 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -16,10 +16,10 @@ RUN groupadd --gid $USER_GID $USERNAME \
 RUN mkdir /data && chown -R ${USERNAME}:${USERNAME} /data
 
 WORKDIR /app
-COPY --from=base --chown=${USER_UID}:${USER_GID} /app/node_modules /app/node_modules
-ADD --chown=${USER_UID}:${USER_GID} package.json app.js ./
-ADD --chown=${USER_UID}:${USER_GID} src ./src
-ADD --chown=${USER_UID}:${USER_GID} migrations ./migrations
+COPY --from=base /app/node_modules /app/node_modules
+ADD package.json app.js ./
+ADD src ./src
+ADD migrations ./migrations
 USER ${USER_UID}
 ENTRYPOINT ["/usr/bin/tini","-g",  "--"]
 EXPOSE 5006

diff --git a/docker/edge-alpine.Dockerfile b/docker/edge-alpine.Dockerfile
@@ -24,11 +24,11 @@ RUN addgroup -S ${USERNAME} -g ${USER_GID} && adduser -S ${USERNAME} -G ${USERNA
 RUN mkdir /data && chown -R ${USERNAME}:${USERNAME} /data
 
 WORKDIR /app
-COPY --from=base --chown=${USER_UID}:${USER_GID} /app/node_modules /app/node_modules
-COPY --from=base --chown=${USER_UID}:${USER_GID} /public /public
-ADD --chown=${USER_UID}:${USER_GID} package.json app.js ./
-ADD --chown=${USER_UID}:${USER_GID} src ./src
-ADD --chown=${USER_UID}:${USER_GID} migrations ./migrations
+COPY --from=base /app/node_modules /app/node_modules
+COPY --from=base /public /public
+ADD package.json app.js ./
+ADD src ./src
+ADD migrations ./migrations
 USER ${USER_UID}
 ENTRYPOINT ["/sbin/tini","-g",  "--"]
 ENV ACTUAL_WEB_ROOT=/public

diff --git a/docker/edge-ubuntu.Dockerfile b/docker/edge-ubuntu.Dockerfile
@@ -24,11 +24,11 @@ RUN groupadd --gid $USER_GID $USERNAME \
 RUN mkdir /data && chown -R ${USERNAME}:${USERNAME} /data
 
 WORKDIR /app
-COPY --from=base --chown=${USER_UID}:${USER_GID} /app/node_modules /app/node_modules
-COPY --from=base --chown=${USER_UID}:${USER_GID} /public /public
-ADD --chown=${USER_UID}:${USER_GID} package.json app.js ./
-ADD --chown=${USER_UID}:${USER_GID} src ./src
-ADD --chown=${USER_UID}:${USER_GID} migrations ./migrations
+COPY --from=base /app/node_modules /app/node_modules
+COPY --from=base /public /public
+ADD package.json app.js ./
+ADD src ./src
+ADD migrations ./migrations
 USER ${USER_UID}
 ENTRYPOINT ["/usr/bin/tini","-g",  "--"]
 ENV ACTUAL_WEB_ROOT=/public

diff --git a/docker/stable-alpine.Dockerfile b/docker/stable-alpine.Dockerfile
@@ -16,10 +16,10 @@ RUN addgroup -S ${USERNAME} -g ${USER_GID} && adduser -S ${USERNAME} -G ${USERNA
 RUN mkdir /data && chown -R ${USERNAME}:${USERNAME} /data
 
 WORKDIR /app
-COPY --from=base --chown=${USER_UID}:${USER_GID} /app/node_modules /app/node_modules
-ADD --chown=${USER_UID}:${USER_GID} package.json app.js ./
-ADD --chown=${USER_UID}:${USER_GID} src ./src
-ADD --chown=${USER_UID}:${USER_GID} migrations ./migrations
+COPY --from=base /app/node_modules /app/node_modules
+ADD package.json app.js ./
+ADD src ./src
+ADD migrations ./migrations
 USER ${USER_UID}
 ENTRYPOINT ["/sbin/tini","-g",  "--"]
 EXPOSE 5006

diff --git a/docker/stable-ubuntu.Dockerfile b/docker/stable-ubuntu.Dockerfile
@@ -16,10 +16,10 @@ RUN groupadd --gid $USER_GID $USERNAME \
 RUN mkdir /data && chown -R ${USERNAME}:${USERNAME} /data
 
 WORKDIR /app
-COPY --from=base --chown=${USER_UID}:${USER_GID} /app/node_modules /app/node_modules
-ADD --chown=${USER_UID}:${USER_GID} package.json app.js ./
-ADD --chown=${USER_UID}:${USER_GID} src ./src
-ADD --chown=${USER_UID}:${USER_GID} migrations ./migrations
+COPY --from=base /app/node_modules /app/node_modules
+ADD package.json app.js ./
+ADD src ./src
+ADD migrations ./migrations
 USER ${USER_UID}
 ENTRYPOINT ["/usr/bin/tini","-g",  "--"]
 EXPOSE 5006