Fix Semgrep finding by adding no-new-privileges:true to MongoDB container

[girichinna27]

Hi Maintainers 👋,

I’m submitting this PR to address a Semgrep medium-severity security finding in the project’s docker-compose.yml.

🔍 Issue

Rule ID: no-new-privileges
Semgrep Message: Service mongodb_container allows for privilege escalation via setuid or setgid binaries. Add no-new-privileges:true in security_opt to prevent this.

📍 Location

File: /tools/scanResult/unzipped-3949820752/caching/docker-compose.yml
Line: 28

✅ Fix

Added the following to the mongodb_container service:

security_opt:

• no-new-privileges:true

🎯 Outcome

This prevents privilege escalation inside the container by ensuring the container cannot gain new privileges (even if setuid/setgid binaries exist).

This remediation was identified and validated using AI-Guardian, an internal security tool developed by my company OpsMx.

Thanks for reviewing the PR 🙏

[github-actions]

PR Summary

Addressed a Semgrep medium-severity finding in docker-compose.yml by adding security_opt: no-new-privileges:true to the mongodb_container service. This prevents privilege escalation by ensuring the container cannot gain new privileges, even if setuid/setgid binaries exist. Change verified via AI-Guardian.

Changes

File	Summary
caching/docker-compose.yml	Added security_opt with no-new-privileges:true to the mongodb_container service to prevent privilege escalation. This aligns with the Semgrep rule no-new-privileges and ensures the container cannot gain new privileges (even if setuid/setgid binaries exist).

---

autogenerated by presubmit.ai

[github-actions]

🚨 Pull request needs attention.

Review Summary

Commits Considered (2)

• 376f9f0: Merge pull request #1 from girichinna27/fix/semgrep-no-new-privileges-28-w4DGwTfzTo

fix: semgrep-no-new-privileges

• e5e4049: fix: no-new-privileges-28

Files Processed (1)

• caching/docker-compose.yml (1 hunk)

Actionable Comments (1)

• caching/docker-compose.yml [37-38]

  security: "Incorrect syntax for no-new-privileges in docker-compose"

Skipped Comments (0)

[github-actions]

The security_opt value currently uses 'no-new-privileges:true', which is not a valid flag for Docker's security options. The correct syntax is "security_opt: - no-new-privileges" (i.e., a single boolean flag in the list). Without this correction, the no-new-privileges setting may be ignored.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud