Flagsmith / Flagsmith/flagsmith
Strip test settings and fixtures from Enterprise container image
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 124
Description
## Context
The Flagsmith Enterprise container image ships with the Django test-settings module at:
```
/app/app/settings/test.py
```
This file contains a `SUBSCRIPTION_LICENCE_PRIVATE_KEY` test fixture (an RSA private key) used only by the unit test suite to validate license signature logic. It is only loaded when `DJANGO_SETTINGS_MODULE=app.settings.test`, so it is not used at runtime in any production or Enterprise deployment. The key is also already public as part of the open-source repo (`api/app/settings/test.py`), so it is not a real secret exposure.
However, because the file is present inside the production image, security scanners flag it as a High-severity finding (private key embedded in container). This blocks compliance workflows for Enterprise customers whose internal policies require all High severity findings to be resolved before production rollout.
## Proposed fix
Exclude `app/settings/test.py` (and other test-only fixtures, if any) from the production Enterprise Docker image build. Options to consider:
- Use a multi-stage Dockerfile that copies only the production settings files
- Add a `.dockerignore` exclusion for test settings in the Enterprise image context
- Move the test RSA keypair into the test suite itself (e.g. under `tests/`) so it never ships with the application code
## Impact
- Unblocks Enterprise customers whose security reviews flag the file
- Reduces false positive security findings across all Enterprise deployments
- No functional impact on production runtime
## References
- File: https://github.com/Flagsmith/flagsmith/blob/main/api/app/settings/test.py
Contributor guide
Research direction
Start with the Enterprise Docker build configuration and the referenced api/app/settings/test.py to identify which test-only files enter the production image. Verify the resulting image no longer contains the test settings or fixtures, while the unit test suite still loads its test settings and the production image builds and runs successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100