apache / apache/shenyu

[Task] — Integrated-test & examples Dockerfiles run as root, no HEALTHCHECK, no LABEL

Open
#6,819 1 comment 0 reactions 0 assignees View on GitHub
priority: medium type: build
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium; files: all of `shenyu-integrated-test/*/Dockerfile` and `shenyu-examples/*/Dockerfile` (verified via grep — zero `USER`/`HEALTHCHECK`/`LABEL` matches)
- description: e.g. `shenyu-integrated-test-http/Dockerfile` ends with `CMD java -jar ${APP_NAME}.jar` with no `USER`, `HEALTHCHECK`, or OCI `LABEL`. The release dist Dockerfiles (`shenyu-dist/shenyu-{admin,bootstrap}-dist/docker/Dockerfile`) correctly set `USER shenyu`, but these do not.
- impact: Containers run as root; no liveness probe; no image metadata.
- suggested_fix: Add a non-root `USER`, `HEALTHCHECK`, and `LABEL org.opencontainers.image.*`.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Review all Dockerfiles under shenyu-integrated-test/* and shenyu-examples/*, using shenyu-dist/shenyu-{admin,bootstrap}-dist/docker/Dockerfile as the existing reference. Confirm the required non-root USER, HEALTHCHECK, and OCI image LABEL values before editing. Done means every listed Dockerfile contains all three directives and the grep scan no longer reports missing matches.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile, java
Domain
devops, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
57/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.