opencode/NSCT---Neutral-Search-Crawler-Tool
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stage18: docker hardening — non-root user, read-only FS, no-new-privileges, health-check fix, .dockerignore

Browse Source
This commit is contained in:
NSCT Agent
2026-08-28 16:22:23 +00:00
parent b23ff5a565
commit 60679083fa
8 changed files with 2802 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Dockerfile
View File

@@ -1,6 +1,6 @@
# ============================================================
# NSCT — Neutral Search Crawler Tool
# Multi-stage Docker build, non-root user
# Hardened multi-stage Docker build, non-root user, read-only FS
# ============================================================
# ---------- Build stage ----------
@@ -29,9 +29,14 @@ FROM python:3.12-slim AS runtime
ENV PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1
# Minimal packages: curl for health-check, shared libs
RUN apt-get update && apt-get install -y --no-install-recommends \
curl libpq5 \
&& rm -rf /var/lib/apt/lists/*
# Non-root user
RUN groupadd --gid 1000 nsct && \
useradd --uid 1000 --gid nsct --shell /bin/bash --create-home nsct
useradd --uid 1000 --gid nsct --shell /bin/sh --create-home nsct
RUN mkdir -p /app/data && chown -R nsct:nsct /app/data