#513 Security hardening: the Docker image’s runtime user can write the application code

[Anonymous]

Originally created by: athanclark

Docker app image: the runtime user can write the application code.

• Location: deploy/Dockerfile.app:243-248 (COPY --chown=node:node for .next/standalone, server, dist), with USER node at line 257.
• Impact: after RCE, the attacker can modify code to persist across requests (not across a container re-create).
• Fix: copy as root:root, read-only, and leave only a cache dir writable. Consider read_only: true with a tmpfs in compose.yml.

---

From the security review of 2026-11-06 (commit 6776c44), finding I-12: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed