78459df962
This is a major issue. Docker Images were built and published with a root user in the CI. if a user manages to break out of the application running as root in the container, he may gain root user access on host. In addition, configuring container to user unprivileged is the best way yo prevent privilege escalation attacks. We mitigated this issue by creating a new environment variable DOCKER_USER. DOCKER_USER is set with id -u and id -g outputs. Then, it is passed as a build-args when running docker/build-push-action steps.
83 lines
2.2 KiB
YAML
83 lines
2.2 KiB
YAML
name: Docker Hub Workflow
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
branches:
|
|
- 'main'
|
|
|
|
env:
|
|
DOCKER_USER: 1001:127
|
|
|
|
jobs:
|
|
build-and-push-backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v4
|
|
-
|
|
name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: lasuite/people-backend
|
|
-
|
|
name: Load sops secrets
|
|
uses: rouja/actions-sops@main
|
|
with:
|
|
secret-file: .github/workflows/secrets.enc.env
|
|
age-key: ${{ secrets.SOPS_PRIVATE }}
|
|
-
|
|
name: Login to DockerHub
|
|
if: github.event_name != 'pull_request'
|
|
run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
|
|
-
|
|
name: Build and push
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
target: production
|
|
build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
build-and-push-frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v4
|
|
-
|
|
name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: lasuite/people-frontend
|
|
-
|
|
name: Load sops secrets
|
|
uses: rouja/actions-sops@main
|
|
with:
|
|
secret-file: .github/workflows/secrets.enc.env
|
|
age-key: ${{ secrets.SOPS_PRIVATE }}
|
|
-
|
|
name: Login to DockerHub
|
|
if: github.event_name != 'pull_request'
|
|
run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
|
|
-
|
|
name: Build and push
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
target: frontend
|
|
build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|