From db1a347f09f5b14b490aaf5114fe96f83c9e8b15 Mon Sep 17 00:00:00 2001 From: KoalaGeo Date: Thu, 7 May 2026 10:35:03 +0100 Subject: [PATCH] Run as non-root user in dockerfile --- Dockerfile | 12 +++++++++--- README.md | 4 ++-- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index fd431eee..7a609f8b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,18 @@ FROM python:3.13.5-slim +# Create a non-root user with a known UID for k8s securityContext.runAsUser +RUN groupadd -g 1000 -r appgroup \ + && useradd -u 1000 -r -g appgroup -d /code -s /sbin/nologin appuser + WORKDIR /code COPY ./requirements.txt /code/requirements.txt RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt -COPY ./app /code/app +COPY --chown=appuser:appgroup ./app /code/app + +USER appuser -EXPOSE 80 -CMD ["fastapi", "run", "app/main.py", "--port", "80"] +EXPOSE 8000 +CMD ["fastapi", "run", "app/main.py", "--port", "8000"] \ No newline at end of file diff --git a/README.md b/README.md index 361b118b..87fda588 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ BGS Deployed Instance available at: [https://agsapi.bgs.ac.uk/](https://agsapi.b The simplest way to run the validation service is via Docker: ``` -docker run -p 80:80 --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi:latest +docker run -p 80:8000 --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi:latest ``` Navigate to [http://localhost](http://localhost) to see the landing page or [http://localhost/docs](http://localhost/docs) to see the API documentation via the Swagger interface. @@ -50,7 +50,7 @@ The `latest` tag reflects the current state of the `main` branch of the reposito If you are running behind a proxy, you may need to set the `root_path` using the `PYAGSAPI_ROOT_PATH` environment variable: ``` -docker run -p 80:80 -e PYAGSAPI_ROOT_PATH="/pyagsapi" --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi +docker run -p 80:8000 -e PYAGSAPI_ROOT_PATH="/pyagsapi" --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi ``` This will ensure that all references to `self` in responses, and all Swagger and REDOC documentation, include the correct path.