harden: non-root docs container with tini and a healthcheck#844
harden: non-root docs container with tini and a healthcheck#844SunsetDrifter wants to merge 2 commits into
Conversation
…point entrypoint.sh: escape sed metacharacters (\, &, #) so any future DocSearch value substitutes literally instead of crashing the pass or corrupting the bundle; rewrite only files that still contain the placeholder, making restarts no-ops; on substitution failure, log a warning and start the server anyway rather than crash-looping under restart: unless-stopped. Dockerfile: run as the built-in non-root node user (artifacts chowned so the runtime sed keeps write access); add tini as PID 1 so SIGTERM actually reaches node and docker stop takes ~1s instead of the 10s kill grace; add a HEALTHCHECK so a dead server shows as unhealthy instead of silently Up. Container-tested: boots 202ms, all routes/assets/redirects OK, metacharacter-laden values injected literally, uid 1000, health reaches healthy, restart idempotent (no rewrites, value intact), docker stop 0s.
…from values Review findings: the three substitutions were &&-chained, so one failing value skipped the remaining valid ones; and a raw newline in a value breaks the single-line sed command. Run each substitution independently, accumulating failures into one warning, and strip CR/LF in escape() (no legitimate DocSearch token contains them). Container-tested: newline-laden appId is sanitized and all three placeholders still apply with no warning; forced full failure logs all three sed errors plus one warning and the server still starts healthy.
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Why
Follow-up hardening on the standalone image (#841). The container ran as root (Trivy DS-0002, flagged by CodeRabbit on #841),
docker stopwaited out the full 10s kill grace becausenoderan as PID 1 with no signal handler, a dead server still showed asUp, and the entrypoint'ssedsubstitution had failure modes that could crash-loop the container or corrupt a value containing#,&, or\.What
Dockerfile
USER node(UID 1000), with copied artifacts chowned so the runtime placeholder substitution keeps write access. Port 3000 is unprivileged.tinias PID 1 so SIGTERM actually reachesnode—docker stopnow terminates in ~1s instead of 10s.HEALTHCHECKprobing/— a crash-looping or dead server surfaces asunhealthyindocker ps, compose--wait, and Watchtower instead of sitting silentlyUp.entrypoint.sh
\,&,#) and strip CR/LF, so any future DocSearch value substitutes literally instead of breaking the pass.Deploy notes
ENTRYPOINT/CMDunchanged in shape; same port/env contract as perf: ship a standalone slim Docker image (~590MB → ~283MB) #841).