P0: su-exec in Docker entrypoint may fail silently — container runs as root #4

New Issue

Closed

opened 2026-05-13 20:39:36 -05:00 by null · 2 comments

null commented

2026-05-13 20:39:36 -05:00

Owner

Fixed in 7d476f3. Replaced su-exec with USER nodejs directive in Dockerfile. Container now runs as nodejs user by default with no su-exec fallback to root.

Fixed in 7d476f3. Replaced su-exec with USER nodejs directive in Dockerfile. Container now runs as nodejs user by default with no su-exec fallback to root.

null added the

P0 Critical

bug

infra

labels 2026-05-17 14:25:54 -05:00

null referenced this issue from a commit

2026-05-17 14:44:39 -05:00

fix(security): audit fixes #4 #6 #10 + hero rewrite (batch 0.5.2)

null closed this issue

2026-05-17 14:44:39 -05:00

null referenced this issue from a commit

2026-05-17 14:45:30 -05:00

fix(security): clean up docker-entrypoint per Hudson review

null commented

2026-05-17 14:45:39 -05:00

Author

Owner

Hudson security review (post-fix):

Dockerfile correctly uses USER nodejs — no su-exec needed
Entry point cleaned up: removed chmod 777 (→ chown), removed hardcoded su-exec, added root-detection logic
Entry point is currently unused (Dockerfile uses CMD directly) but now safe if re-enabled
Remediation committed in 7162a26

Issues #6 and #10 passed review — no further action needed.

**Hudson security review (post-fix):** - Dockerfile correctly uses USER nodejs — no su-exec needed - Entry point cleaned up: removed chmod 777 (→ chown), removed hardcoded su-exec, added root-detection logic - Entry point is currently unused (Dockerfile uses CMD directly) but now safe if re-enabled - Remediation committed in 7162a26 Issues #6 and #10 passed review — no further action needed.

null referenced this issue from a commit

2026-05-17 14:46:01 -05:00

fix(security): Hudson remediation + batch 0.5.3 trust signals

null referenced this issue

2026-05-17 14:46:07 -05:00

Batch 0.5.3: Trust signals section — B2B credibility #44

null commented

2026-05-17 14:46:11 -05:00

Author

Owner

Final remediation (7c145bc):

Removed chmod 777 on /app/db and /app/logs → now uses chown -R nodejs:nodejs
Removed hardcoded su-exec call → entrypoint now detects root vs non-root
Entry point is currently unused (Dockerfile uses USER nodejs + CMD) but is safe if re-enabled
Hudson review: PASS with remediation applied

All audit fixes for this issue are complete and verified.

**Final remediation (7c145bc):** - Removed `chmod 777` on /app/db and /app/logs → now uses `chown -R nodejs:nodejs` - Removed hardcoded `su-exec` call → entrypoint now detects root vs non-root - Entry point is currently unused (Dockerfile uses `USER nodejs` + `CMD`) but is safe if re-enabled - Hudson review: PASS with remediation applied All audit fixes for this issue are complete and verified.