unicodeveloper / unicodeveloper/globalthreatmap
Docker image runs as root; no non-root user defined
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.8k
- Forks
- 300
- PR merge metrics
- No merged PRs in 30d
Description
- Context: Cloud
- Category: Vulnerability (Container Privilege Escalation)
- Severity: Medium
Evidence
# Dockerfile
FROM node:20-alpine
RUN corepack enable && ...
WORKDIR /app
COPY ...
RUN pnpm run build
EXPOSE 3000
CMD ["pnpm", "start"]
No USER directive is present. The Node.js process runs as root (UID 0) inside the container. If the application is compromised (e.g., via RCE through a dependency vulnerability), the attacker has full root access to the container filesystem, including all environment variables, mounted secrets (dot_env), and potentially the container runtime socket if it is mounted.
Affected files: Dockerfile
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open Dockerfile and review the image setup, working directory, build commands, and runtime command around the missing USER directive. Build and run the image, then verify that the Node.js process no longer runs with UID 0 and that the application still starts successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, node.js
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100