Run container as non-root user

Add USER 65534:65534 to the scratch runtime image so the checker
process does not run as root.
This commit is contained in:
nemunaire 2026-04-26 01:10:32 +07:00
commit 8b38c43b8a

View file

@ -11,5 +11,6 @@ RUN CGO_ENABLED=0 go build -tags standalone -ldflags "-X main.Version=${CHECKER_
FROM scratch
COPY --from=builder /checker-autoconfig /checker-autoconfig
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
USER 65534:65534
EXPOSE 8080
ENTRYPOINT ["/checker-autoconfig"]