jonas/kirche-einfach
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: edge hardening, rootless containers, fail-closed frontend mode

Browse source
This commit is contained in:
Jonas Miederer 2026-09-14 21:35:06 +02:00
parent d903d0951f
commit e82ce391f6
15 changed files with 260 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

5
backend/Dockerfile
View file

@ -17,9 +17,10 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
# Foundational, inert in prod: non-root user for the editor, sudo for setup,
# openssh-client for the devcontainer post-start hook, curl for the opencode
# installer in setup.sh, git for the VS Code source-control view.
# installer in setup.sh, git for the VS Code source-control view, gosu to
# drop privileges before serving (the server never runs as root).
RUN apt-get update \
&& apt-get install -y --no-install-recommends sudo openssh-client curl git ca-certificates \
&& apt-get install -y --no-install-recommends sudo openssh-client curl git ca-certificates gosu \
&& rm -rf /var/lib/apt/lists/* \
&& useradd -m -s /bin/bash vscode \
&& echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode \