# Possible improvements

- Useful commands when trying to improve images:

  ```bash
  docker logs
  docker diff
  docker exec ...
  trivy
  grype
  ```

---

## What do we know about the app?

- The app is running ~~fine~~

  - It does what it is supposed to do at least

--

- Some improvement areas:

  - All containers are running with root privileges

  - Too many privileges (`man 7 capabilities`)

  - Root filesystem is writeable

--

  - Quite a few CVE's (As a result of the build)

---

## How to improve the `docker-compose.yml` file

- Let's pretend we do not want to modify the original `docker-compose.yml` file

--

  - Changes here might cause issues with upstream updates.

  - Hard to keep track of differences with merge conflicts

--

- Let's override values with `docker-compose.override.yml`

```bash
❯ docker-compose ls
NAME                STATUS              CONFIG FILES
dockercoins         running(5)          docker-compose.yml,docker-compose.override.yml
```

---

## Two files are merged together

`docker-compose.yml`

```yaml
version: "2"

services:
  rng:
    build: rng
    ports:
    - "8001:80"
```

`docker-compose.override.yml`

```yaml
version: "2"

services:
  rng:
    user: "4242:4242"
```

---

## Combined result

- As shown by `docker-compose config`

```yaml
version: "2"

services:
rng:
  build: rng
  ports:
  - "8001:80"
  user: "4242:4242"
```

---

## Starting scenario

- Default without `docker-compose.override.yml`

    - Containers run with `root` identity

    - `/tmp` is writeable

    - 'chown'  is possible

---

## Improvement 1

- Change user id to 4242. Redis can no longer write to `/data` if a volume exists from a previous run so we mount a writeable directory on top of it (or just remove the existing volume)

```yaml
services:
...
  rng:
    user: "4242:4242"
...
  redis:
    user: "4242:4242"
    tmpfs:
      - /data
...
```

---

## Improvement 2

- Lets reduce capabilities to make sure no weird things can happen

```yaml
...
services:
  rng:
    user: "4242:4242"
    cap_drop:
      - ALL

  hasher:
    user: "4242:4242"
    cap_drop:
      - ALL
...
```

- It does not show anything different...

---

## Improvement 3

- Make the root filesystem read only

```yaml
...
services:
  rng:
    user: "4242:4242"
    cap_drop:
      - ALL
    read_only: true
```
