Skip to content

Commit

Permalink
Update docker files to remove /root/.m2 directory after installation …
Browse files Browse the repository at this point in the history
…to not distribute build dependencies (#200)

Part of security hardening: remove `/root/.m2` directory after the
installation has happened.

It seems like it's not needed as it keeps Maven cache, but we already
vendor all dependencies on `make install`.

This way we won't distribute any compile-time dependencies, reducing our
potential attack surface.
  • Loading branch information
artem-shelkovnikov authored Feb 5, 2025
1 parent 01eed26 commit 8708689
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 0 deletions.
3 changes: 3 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,7 @@ COPY . /app
WORKDIR /app
RUN make clean install

# Clean up build dependencies
RUN rm -r /root/.m2

ENTRYPOINT [ "/bin/bash" ]
3 changes: 3 additions & 0 deletions Dockerfile.wolfi
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,9 @@ ENV IS_DOCKER=1

RUN make clean install

# Clean up build dependencies
RUN rm -r /root/.m2

# ------------------------------------------------------------------------------
# remove now-unnecessary packages and directories

Expand Down

0 comments on commit 8708689

Please sign in to comment.