Security: AIO Docker container runs all services as root (CWE-250)

Summary

The AIO community Docker image (deployments/aio/community/Dockerfile) runs all 7 processes (api, space, worker, beat, live, migrator, caddy) as root, violating the principle of least privilege.

Affected File

deployments/aio/community/Dockerfile

Details

Only the Caddy reverse proxy requires elevated privileges to bind ports 80/443. The remaining 6 services (api, space, worker, beat, live, migrator) use unprivileged ports (3000-3005) and have no need for root access.

CWE: CWE-250: Execution with Unnecessary Privileges

Suggested Fix Options

Option A: setcap + non-root user (recommended — no breaking changes)

RUN apk add --no-cache libcap &&     addgroup -g 1000 -S plane &&     adduser -u 1000 -S plane -G plane &&     chown -R plane:plane /app &&     setcap cap_net_bind_service=+ep /usr/bin/caddy
USER plane

• Grants port-binding capability only to Caddy binary
• All other services run unprivileged
• No breaking changes for users (ports 80/443 preserved)

Option B: Unprivileged ports (breaking change)

Change Caddy to listen on :8080/:8443 and map externally via -p 80:8080.
Simpler but requires documentation and config updates.

I'm happy to submit a PR for Option A if the team prefers that approach. Leaving the design decision to the maintainers.

Discovered via automated security scanning.