Security improvements #362
Conversation
WalkthroughA new GitHub Actions workflow for Docker image security scanning was added. The Dockerfile was reformatted and restructured, updating build steps, user creation, and permission handling. The entrypoint script was modified to fix directory permissions at startup. No changes were made to application code or exported entities. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Docker Buildx
participant Anchore Scan
GitHub Actions->>Docker Buildx: Build Docker image from repository
Docker Buildx-->>GitHub Actions: Docker image built
GitHub Actions->>Anchore Scan: Run security scan on built image
Anchore Scan-->>GitHub Actions: Report scan results (fail on issues)
Possibly related PRs
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
Dockerfile (1)
19-20: Avoid caching pip during upgrade and consider pinning pip version
Recommend adding--no-cache-dirtopip install --upgrade pipto prevent unnecessary cache usage:-RUN pip install --upgrade pip && \ +RUN pip install --upgrade pip --no-cache-dir && \Optionally, pin
pipto a specific version for reproducible builds.🧰 Tools
🪛 GitHub Check: Codacy Static Code Analysis
[warning] 19-19: Dockerfile#L19
Pin versions in pip. Instead ofpip install <package>usepip install <package>==<version>orpip install --requirement <requirements file>🪛 GitHub Check: CodeFactor
[warning] 19-19: Dockerfile#L19
Avoid use of cache directory with pip. Usepip install --no-cache-dir <package>. (DL3042).github/workflows/docker-security.yml (1)
24-29: Anchore security scanning configuration
Usinganchore/scan-action@v2withfail-build: truewill block unsafe images. Consider adding an explicit severity threshold or Slack/PR comments on scan failures for quicker feedback loops.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/docker-security.yml(1 hunks)Dockerfile(1 hunks)scripts/entrypoint.sh(1 hunks)
🧰 Additional context used
🪛 GitHub Check: Codacy Static Code Analysis
Dockerfile
[warning] 19-19: Dockerfile#L19
Pin versions in pip. Instead of pip install <package> use pip install <package>==<version> or pip install --requirement <requirements file>
🪛 GitHub Check: CodeFactor
Dockerfile
[warning] 19-19: Dockerfile#L19
Avoid use of cache directory with pip. Use pip install --no-cache-dir <package>. (DL3042)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (8)
Dockerfile (5)
8-15: Cache cleanup refinement in builder stage
Theapt-get cleancommand effectively clears the package cache, and removing/var/lib/apt/lists/*is sufficient to slim the image. This approach is correct and follows best practices.
52-52: Ensure entrypoint script is executable
Thechmod +x ./entrypoint.shcorrectly makes the startup script runnable.
53-54: Clarify the database seed target directory
Copyingsqlite3-dbinto./docker-composemay be confusing (as that path typically holds Compose files). Please verify that./docker-composeis the intended destination for the seed DB and consider renaming it (e.g.,./db-seeds) or documenting this choice.
56-60: Switch to a dedicated non-root user for runtime
Creating a system group and user (fastapi) and chown’ing/appand/sqlite3-dbensures the container process runs with least privilege. This aligns with best security practices.
65-69: Verify ENTRYPOINT privileges
SinceUSER fastapiis declared after theENTRYPOINT, please confirm that Docker will execute the entrypoint script as root (so thatchownin the script succeeds) and then drop tofastapifor the main process. If this isn’t guaranteed, consider movingUSER fastapibelow the build-time chown or performing privilege dropping inside the entrypoint.scripts/entrypoint.sh (1)
3-4: Fixing permissions on the SQLite volume
Logging the permission fix and runningchown -R fastapi:fastapi /sqlite3-dbat startup ensures the mounted volume is writable by the app user. This change reliably addresses permission issues with the DB volume..github/workflows/docker-security.yml (2)
3-8: Validate workflow trigger branches
The workflow only runs on pushes and PRs tomaster. Verify that your default branch is indeed namedmaster; otherwise, the scan won’t trigger.
21-23: Docker image build for scanning
Building the image viadocker build -t python-samples-fastapi-restful .prepares it for Anchore analysis. You may later extend this step to tag images with a version or SHA for traceability.
|
Thanks for the contribution @morettimaxi! I'm closing this PR for now because several checks are failing. However, I will keep the branch and work on the following improvements:
I will likely create a GitHub issue to track these tasks and ensure consistency. |
2 participants
This change is
🔒 Docker Hardening & Trivy Security Scan Integration
This PR introduces 3 key security-focused changes to improve the overall posture of our Docker-based FastAPI application:
🐳 1. Dockerfile Permissions Fix
We modified file permissions during image creation to avoid unsafe defaults like 775 that could allow any user to execute or modify files inside the container.
Before: Files were being copied with default permissions, sometimes resulting in 775, which is dangerous in multi-user environments.
Now: Explicit chmod 644 ensures:
Owner can read/write
Group and others can only read
No executable flag unless required
This prevents unauthorized execution or tampering from other users.
✅ Best practices applied: Least privilege, immutable file system.
🧪 2. Trivy Vulnerability Scanning
We integrated Aqua Security's Trivy as part of the CI/CD pipeline.
Docker image is scanned on every push, pull_request, or workflow_dispatch.
Results are uploaded as an artifact and printed in the GitHub Actions logs.
Current report includes Debian 12.10 base image and Python packages.
📄 Output format: clean table, stored in trivy-report.txt.
🚀 3. ENTRYPOINT Adjustment
We added a safe and minimal ENTRYPOINT to prevent arbitrary execution or misuse.
It avoids default shell context (no leftover commands)
Ensures predictable startup
Compatible with production container behavior
Summary by CodeRabbit