From 634e16403e3243cfdc51ad289dcc156040253d08 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sun, 7 Jun 2026 16:35:43 +0200 Subject: [PATCH] security(docker): run the player/web images as non-root (refs #451) The soundtouch-player image (and its transitional soundtouch-web alias) ran as root for no reason: the player is stateless, binds an unprivileged port (8080), and its mDNS/SSDP discovery uses unprivileged multicast. Drop to USER nobody. Verified the image starts, binds 8080, and discovers as uid 65534. The soundtouch-service image is left as root for now: it persists to /app/data (commonly a host-mounted volume whose ownership we can't assume) and its optional built-in DNS server binds the privileged :53. Making it non-root needs a chowned data dir plus NET_BIND_SERVICE (or moving DNS off :53), so it's handled separately. Co-Authored-By: Claude Opus 4.8 (1M context) --- Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Dockerfile b/Dockerfile index 934b8bf..5c767dc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -107,6 +107,10 @@ ENV PORT=8080 EXPOSE 8080 +# The player is stateless and binds an unprivileged port, so it has no reason +# to run as root. mDNS/SSDP discovery uses unprivileged multicast. +USER nobody + ENTRYPOINT ["/app/soundtouch-player"] # soundtouch-web image: transitional alias of soundtouch-player. Built from the @@ -124,4 +128,6 @@ ENV PORT=8080 EXPOSE 8080 +USER nobody + ENTRYPOINT ["/app/soundtouch-web"]