From 2c45e599c02d42e1619c66e285993e8d21e58da5 Mon Sep 17 00:00:00 2001 From: derekc Date: Mon, 25 May 2026 01:06:40 -0700 Subject: [PATCH] Run backend as non-root user, add resource limits to all containers - Dockerfile: create and switch to unprivileged appuser (HIGH fix) - docker-compose: mem_limit + cpus on nginx (128m/0.25), backend (512m/0.5), db (512m/0.5) Co-Authored-By: Claude Sonnet 4.6 --- backend/Dockerfile | 3 +++ docker-compose.yml | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/backend/Dockerfile b/backend/Dockerfile index 0b9158f..dbe50a6 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -7,4 +7,7 @@ RUN pip install --no-cache-dir -r requirements.txt COPY app/ ./app/ +RUN useradd -r -s /bin/false appuser +USER appuser + CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"] diff --git a/docker-compose.yml b/docker-compose.yml index 2d7bf10..e56179c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,6 +9,8 @@ services: depends_on: - backend restart: unless-stopped + mem_limit: 128m + cpus: 0.25 backend: build: ./backend @@ -23,6 +25,8 @@ services: db: condition: service_healthy restart: unless-stopped + mem_limit: 512m + cpus: 0.5 healthcheck: test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"] interval: 10s @@ -45,6 +49,8 @@ services: timeout: 5s retries: 10 restart: unless-stopped + mem_limit: 512m + cpus: 0.5 volumes: mysql_data: