hyperledger / hyperledger/fabric
Dockerfile doesn't specify USER
Open
- Dominant language
- Go
- Stars
- 16.7k
- Forks
- 9.1k
- Avg merge
- 5h 38m
- Merged PRs (30d)
- 26
Description
### Description
By not specifying a USER, a program in the container may run as root. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than root.
images/orderer/Dockerfile:73
{CMD [ "orderer", "start" ]}
images/peer/Dockerfile:77
{VOLUME /etc/hyperledger/fabric
VOLUME /var/hyperledger
EXPOSE 7051
CMD [ "peer", "node", "start" ]}
References
https://owasp.org/Top10/A04_2021-Insecure_Design
### Steps to reproduce
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.