chore(containers): comply with SonarQube docker:S6504 #357
Conversation
WalkthroughA new Changes
Sequence Diagram(s)sequenceDiagram
participant Developer
participant VSCode
Developer ->> VSCode: Open project
VSCode ->> .vscode/extensions.json: Read recommended extensions
VSCode -->> Developer: Suggest installation of recommended extensions
sequenceDiagram
participant Docker
participant BuildStage as "builder (build stage)"
participant RuntimeStage as "runtime (final stage)"
Docker->>BuildStage: Install build dependencies
BuildStage->>BuildStage: Copy requirements.txt, build wheels
BuildStage->>BuildStage: Clean up caches
Docker->>RuntimeStage: Add metadata labels
RuntimeStage->>RuntimeStage: Copy wheels, install dependencies with ownership
RuntimeStage->>RuntimeStage: Copy app files, README, assets with permissions
RuntimeStage->>RuntimeStage: Create non-root user
RuntimeStage->>RuntimeStage: Set environment, expose port, set CMD
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #357 +/- ##
=======================================
Coverage 89.18% 89.18%
=======================================
Files 2 2
Lines 111 111
=======================================
Hits 99 99
Misses 12 12
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
Dockerfile (2)
7-9: Pin apt-get package versions for reproducible builds.Currently,
apt-get install -y build-essential gcc libffi-dev libssl-devinstalls the latest packages which may change over time. Pinning these packages to specific versions will make the build deterministic and prevent unexpected updates. For example:RUN apt-get update && \ apt-get install -y --no-install-recommends \ build-essential=12.6ubuntu4 gcc-12-base=12.6.0-2 libffi-dev=3.4.2-3ubuntu1 libssl-dev=3.0.2-0ubuntu1 && \ rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.debPlease adjust versions to match your target distribution release.
🧰 Tools
🪛 GitHub Check: Codeac Code Quality
[warning] 7-7: DL3008
Pin versions in apt get install. Instead ofapt-get install <package>useapt-get install <package>=<version>
21-25: Optional: Include version and revision labels.Consider adding
org.opencontainers.image.version(e.g., image tag or application version) andorg.opencontainers.image.revision(git commit SHA) to enhance traceability of your container images.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.vscode/extensions.json(1 hunks)Dockerfile(1 hunks)
🧰 Additional context used
🪛 GitHub Check: Codeac Code Quality
Dockerfile
[warning] 7-7: DL3008
Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (6)
.vscode/extensions.json (1)
1-14: Approve recommended VSCode extensions.The list covers key tooling for Python development, GitHub integration, container workflows, YAML editing, code quality checks, formatting, conventional commits, and
.gitignoresupport. This will help standardize and streamline the developer experience.Dockerfile (5)
12-14: Verify BuildKit support for--chownand--chmodflags.The
--chmodflag onCOPYrequires Docker BuildKit (Docker 20.10+). Ensure that your CI pipeline and local builds enable BuildKit; otherwise, these flags will be ignored or cause errors. If BuildKit is not available, you may need to fall back to:COPY requirements.txt . RUN chown root:root requirements.txt && chmod 644 requirements.txtAlso applies to: 27-29
21-25: Metadata labels improve image discoverability.The added
org.opencontainers.image.*labels clearly document the image title, description, license, and source repository. This aligns with best practices for OCI image metadata.
33-39: Read-only file permissions for application code.Application files (
main.py, directories under/app) are copied with--chmod=644/755and owned byroot:root, ensuring immutability at runtime. This satisfies the SonarQube rule docker:S6504 and aligns with container immutability best practices.
45-49: Dropping to a non-root user enhances security.Creating a system user (
fastapi) and switching to it at runtime (USER fastapi) follows the principle of least privilege, preventing the application from running as root. Well done.
50-56: Entrypoint and environment configuration look solid.Setting
PYTHONUNBUFFERED=1ensures timely logging, exposing port 9000 and the Uvicorn command are correct. This setup maintains application observability and network accessibility.
All files in the runtime image are now owned by root and made read-only.
This prevents non-root users from modifying code or config at runtime,
in line with container immutability best practices.
Permissions are set using
--chownand--chmodatCOPYtimeto avoid insecure defaults. No chown/chmod is performed at runtime.
Related to: CWE-732, docker:S6504
This change is
Summary by CodeRabbit