Skip to content

Conversation

@cmosetick
Copy link

  • chown all files to root (0:0) for read-only access
  • All files owned by root (0:0) instead of random UIDs
  • Cache directories still writable by non-root users
  • Can be used by downstream Dockerfiles with specific UID

example downstream Dockerfile snippet:

USER 1000:1000
WORKDIR /app
COPY --chown=1000:1000 . .

@cmosetick cmosetick merged commit 97de9c1 into main Dec 19, 2025
1 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants