Skip to content
This repository was archived by the owner on Jul 28, 2026. It is now read-only.

Fixed Java container installing gnupg #45

Merged
dfreniche merged 4 commits into from
Jul 28, 2026
Merged

Fixed Java container installing gnupg #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f495f27
Fixed Java container installing gnupg
dfreniche Jul 21, 2026
f669b7a
Merge branch 'main' into fix-java-cotainer
dfreniche Jul 21, 2026
93fbd59
Added devcontainer-lock.json
dfreniche Jul 28, 2026
3637a59
Removed deprecated VS Code extension
dfreniche Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
FROM mcr.microsoft.com/devcontainers/java:1-21-bookworm

@semgrep-code-mongodb semgrep-code-mongodb Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that a USER directive is defined in the Dockerfile.

To resolve this comment:

✨ Commit fix suggestion

  1. Keep the base image as-is, but add a USER directive in the Dockerfile so the container does not start as root.

  2. Place the USER directive after the RUN steps that need package installation, because apt-get usually requires root privileges.

  3. Switch to a non-root account that already exists in this base image, if available. For Microsoft devcontainer images, that is commonly vscode, so add USER vscode near the end of the Dockerfile.

  4. Update file ownership before switching users if later steps need write access to application directories. For example, use RUN chown -R vscode:vscode /path/to/app before USER vscode.

  5. Alternatively, if this image does not already include a non-root user, create one first and then switch to it with USER appuser. For example, add RUN useradd -m -u 10001 appuser and then USER appuser. Running as a non-root user limits what an attacker can do inside the container.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by missing-user-definition.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

@dfreniche dfreniche Jul 28, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/ar as these containers run in GitHub's infra or in Instruqt, never on Atlas this "risk" is harmless. They can destroy the container if they want.


# Ensure gnupg/curl available and add Yarn APT public key so apt can verify the repo
RUN set -eux \
# Temporarily move Yarn APT source if present so apt-get update doesn't fail
&& mv /etc/apt/sources.list.d/yarn*.list /tmp/ 2>/dev/null || true \
&& apt-get update \
&& apt-get install -y --no-install-recommends gnupg dirmngr ca-certificates curl \
&& curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/yarn-archive-keyring.gpg \
# Restore any moved Yarn source list(s)
&& mv /tmp/yarn*.list /etc/apt/sources.list.d/ 2>/dev/null || true \
&& rm -rf /var/lib/apt/lists/*
19 changes: 19 additions & 0 deletions .devcontainer/devcontainer-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
{
"features": {
"ghcr.io/devcontainers/features/dotnet:2.3.0": {
"version": "2.3.0",
"resolved": "ghcr.io/devcontainers/features/dotnet@sha256:edcfa7fed1eb62fc3b742b5a13e2279da4721dfd766819f04b24f4981ae99764",
"integrity": "sha256:edcfa7fed1eb62fc3b742b5a13e2279da4721dfd766819f04b24f4981ae99764"
},
"ghcr.io/devcontainers/features/java:1": {
"version": "1.8.0",
"resolved": "ghcr.io/devcontainers/features/java@sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a",
"integrity": "sha256:9663ce0219ff85786e87901ce5f0a59f488edd5f99b46015192cda48468b233a"
},
"ghcr.io/devcontainers/features/python:1": {
"version": "1.8.0",
"resolved": "ghcr.io/devcontainers/features/python@sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511",
"integrity": "sha256:fbcad6955caeecc5ad3f7886baf652e25cba5225a6c4c2287c536de2e5607511"
}
}
}
3 changes: 1 addition & 2 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,7 @@
"extensions": [
"ms-toolsai.jupyter",
"mongodb.mongodb-vscode",
"ms-dotnettools.csharp",
"ms-dotnettools.dotnet-interactive-vscode"
"ms-dotnettools.csharp"
]
}
},
Expand Down
4 changes: 3 additions & 1 deletion .devcontainer/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@ version: '3.8'

services:
jedee:
image: mcr.microsoft.com/devcontainers/java:1-21-bookworm
build:
context: .
dockerfile: Dockerfile
volumes:
- ../..:/workspaces:cached

Expand Down
Loading