svrnty/docker-base-distro
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 13 Wiki Activity

Add USER 65532 to generated Dockerfile for non-root compliance
Some checks failed
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Waiting to run
Details
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Waiting to run
Details
Weekly Rebuild (CVE Updates) / rebuild (apko/flutter-sdk.yaml, flutter-sdk) (push) Waiting to run
Details
Check for Upstream Stable Updates / Check Wolfi package updates (push) Waiting to run
Details
Check for Upstream Stable Updates / Check .NET stable releases (push) Waiting to run
Details
Check for Upstream Stable Updates / Check Flutter stable releases (push) Waiting to run
Details
Check for Upstream Stable Updates / Rebuild and push all variants (apko/base.yaml, base) (push) Blocked by required conditions
Details
Check for Upstream Stable Updates / Rebuild and push all variants (apko/build.yaml, build) (push) Blocked by required conditions
Details
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Blocked by required conditions
Details
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Blocked by required conditions
Details
Check for Upstream Stable Updates / Rebuild and push all variants (apko/flutter-sdk.yaml, flutter-sdk) (push) Blocked by required conditions
Details
Check for Upstream Stable Updates / Create release for new Flutter version (push) Blocked by required conditions
Details
Build and Push Base Distro Images / build-and-push (apko/base.yaml, base) (push) Successful in 49s
Details
Build and Push Base Distro Images / build-and-push (apko/build.yaml, build) (push) Successful in 58s
Details
Build and Push Base Distro Images / build-and-push (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Successful in 51s
Details
Build and Push Base Distro Images / build-and-push (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Successful in 1m8s
Details
Build and Push Base Distro Images / build-and-push (apko/flutter-sdk.yaml, flutter-sdk) (push) Successful in 39s
Details
Weekly Rebuild (CVE Updates) / rebuild (apko/build.yaml, build) (push) Has been cancelled
Details
Weekly Rebuild (CVE Updates) / rebuild (apko/base.yaml, base) (push) Has been cancelled
Details

Browse Source 
The FROM scratch + ADD pattern loses apko's OCI config metadata including
the run-as user. Adding USER 65532 to the Dockerfile restores the
non-root default that Docker Scout checks for.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Mathias Beaulieu-Duncan 2026-02-02 10:34:15 -05:00
parent 7c2d558a35
commit f72130c6bf
3 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitea/workflows/publish.yaml
View File

@ -117,6 +117,7 @@ jobs:
/tmp/image.tar /tmp/image.tar
echo 'FROM scratch' > /tmp/Dockerfile echo 'FROM scratch' > /tmp/Dockerfile
echo 'ADD image.tar /' >> /tmp/Dockerfile echo 'ADD image.tar /' >> /tmp/Dockerfile
echo 'USER 65532' >> /tmp/Dockerfile
- name: Build and push with buildx (SBOM + provenance) - name: Build and push with buildx (SBOM + provenance)
uses: docker/build-push-action@v5 uses: docker/build-push-action@v5

1
.gitea/workflows/rebuild.yaml
View File

@ -109,6 +109,7 @@ jobs:
/tmp/image.tar /tmp/image.tar
echo 'FROM scratch' > /tmp/Dockerfile echo 'FROM scratch' > /tmp/Dockerfile
echo 'ADD image.tar /' >> /tmp/Dockerfile echo 'ADD image.tar /' >> /tmp/Dockerfile
echo 'USER 65532' >> /tmp/Dockerfile
- name: Build and push with buildx (SBOM + provenance) - name: Build and push with buildx (SBOM + provenance)
uses: docker/build-push-action@v5 uses: docker/build-push-action@v5

1
.gitea/workflows/update-check.yaml
View File

@ -199,6 +199,7 @@ jobs:
/tmp/image.tar /tmp/image.tar
echo 'FROM scratch' > /tmp/Dockerfile echo 'FROM scratch' > /tmp/Dockerfile
echo 'ADD image.tar /' >> /tmp/Dockerfile echo 'ADD image.tar /' >> /tmp/Dockerfile
echo 'USER 65532' >> /tmp/Dockerfile
- name: Build and push with buildx (SBOM + provenance) - name: Build and push with buildx (SBOM + provenance)
uses: docker/build-push-action@v5 uses: docker/build-push-action@v5