From 669e8ff005286c0399615c933ee074a85324af7d Mon Sep 17 00:00:00 2001 From: Andriy Oblivantsev Date: Wed, 8 Jul 2026 20:20:19 +0100 Subject: [PATCH] fix: run simulator image as non-root user (Trivy DS-0002) Add swarm uid 10001 in both build stages so Trivy config scan passes and containers do not run as root. Mounted /data volumes should be world-writable or owned by uid 10001 (var/t1 from Ansible is 0777). --- simulator/Dockerfile | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/simulator/Dockerfile b/simulator/Dockerfile index 85d235e..b2d27a9 100644 --- a/simulator/Dockerfile +++ b/simulator/Dockerfile @@ -7,6 +7,10 @@ COPY virtual_drone ./virtual_drone COPY monitoring ./monitoring COPY explorer ./explorer COPY tests ./tests +RUN groupadd --gid 10001 swarm \ + && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \ + && chown -R swarm:swarm /app +USER swarm RUN pytest tests/ -q FROM python:3.12-slim @@ -19,6 +23,11 @@ COPY virtual_drone ./virtual_drone # them without bind mounts (Compose overrides these with live mounts) COPY monitoring ./monitoring COPY explorer ./explorer +RUN groupadd --gid 10001 swarm \ + && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \ + && mkdir -p /data \ + && chown -R swarm:swarm /app /data ENV DATA_DIR=/data +USER swarm CMD ["python", "-m", "virtual_drone.main"]