hyperledger / hyperledger/fabric

Dockerfile doesn't specify USER

Open
#5,070 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
16.7k
Forks
9.1k
Avg merge
5h 38m
Merged PRs (30d)
26

Description

### Description

By not specifying a USER, a program in the container may run as root. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than root.

images/orderer/Dockerfile:73
{CMD [ "orderer", "start" ]}

images/peer/Dockerfile:77

{VOLUME /etc/hyperledger/fabric
VOLUME /var/hyperledger

EXPOSE 7051

CMD [ "peer", "node", "start" ]}

References

https://owasp.org/Top10/A04_2021-Insecure_Design

### Steps to reproduce

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.