Flagsmith / Flagsmith/flagsmith

Strip test settings and fixtures from Enterprise container image

Open
#7,271 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.6k
Forks
567
Avg merge
1d 14h
Merged PRs (30d)
124

Description

## Context

The Flagsmith Enterprise container image ships with the Django test-settings module at:

```
/app/app/settings/test.py
```

This file contains a `SUBSCRIPTION_LICENCE_PRIVATE_KEY` test fixture (an RSA private key) used only by the unit test suite to validate license signature logic. It is only loaded when `DJANGO_SETTINGS_MODULE=app.settings.test`, so it is not used at runtime in any production or Enterprise deployment. The key is also already public as part of the open-source repo (`api/app/settings/test.py`), so it is not a real secret exposure.

However, because the file is present inside the production image, security scanners flag it as a High-severity finding (private key embedded in container). This blocks compliance workflows for Enterprise customers whose internal policies require all High severity findings to be resolved before production rollout.

## Proposed fix

Exclude `app/settings/test.py` (and other test-only fixtures, if any) from the production Enterprise Docker image build. Options to consider:

- Use a multi-stage Dockerfile that copies only the production settings files
- Add a `.dockerignore` exclusion for test settings in the Enterprise image context
- Move the test RSA keypair into the test suite itself (e.g. under `tests/`) so it never ships with the application code

## Impact

- Unblocks Enterprise customers whose security reviews flag the file
- Reduces false positive security findings across all Enterprise deployments
- No functional impact on production runtime

## References

- File: https://github.com/Flagsmith/flagsmith/blob/main/api/app/settings/test.py

Contributor guide

Open the contributing guide

Research direction

Start with the Enterprise Docker build configuration and the referenced api/app/settings/test.py to identify which test-only files enter the production image. Verify the resulting image no longer contains the test settings or fixtures, while the unit test suite still loads its test settings and the production image builds and runs successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
devops, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.