build: push image to project ghcr registry - #17
Open
sbp-bvanb wants to merge 13 commits into
Open
Conversation
…ache - Accept NODE_VERSION, --chmod, and CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS keys in dockle to suppress CIS-DI-0010 false positives - Add rm -rf /var/lib/apt/lists/* after glab apt-get install to fix DKL-DI-0005 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…arnings Add --strip-components, DISABLE_AUTOUPDATER, ARCH, and nodejs to the dockle-accept-key list; all are build-time shell variables or package names misidentified as credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-root user Separate build-time tooling (curl, gnupg, unzip, apt repo infrastructure) from the runtime image. The installer stage downloads and verifies all binaries; the runtime stage starts fresh and only installs runtime apt packages, copying binaries from the installer stage. npm globals use an explicit /opt/npm-global prefix for predictable COPY paths. Bake a `claude` user at UID/GID 999 in the runtime image and update the entrypoint fallback (HOST_UID=0) to drop to that user instead of running as root, so the container workload is never root by default. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…mp node to 24.18.1 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…d Dockerfile - chmod -s account-management, mount, and host-based SSH auth binaries that this container never exercises (entrypoint drops privilege via runuser, not su), closing off privilege-escalation paths for the claude user (dockle CIS-DI-0008) - remove /opt/tfenv/Dockerfile, an unnecessary file bundled in tfenv's release tarball (dockle DKL-LI-0003) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Root-start-then-drop is load-bearing, not a fixable oversight: the entrypoint needs root to chown /root to the host UID and useradd a matching passwd entry before dropping via runuser, and no-new-privileges rules out a file-capability workaround. Document why alongside the existing Dockerfile comment instead of letting dockle flag it every run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
806b843 baked a static claude user/group (999:999) into the image but left the entrypoint's runtime UID-mapping untouched, causing two regressions: - Non-zero HOST_UID: useradd/groupadd tried to create a SECOND account named `claude`, which always fails with "already exists" once the name (not just the UID/GID) collides — i.e. on every real host UID. Fixed by usermod/groupmod-ing the existing baked account instead. - HOST_UID=0 (unset): the entrypoint dropped to the baked-in claude account but skipped the chown walk (early exit), leaving /root root-owned 0700 — claude couldn't even traverse into its own HOME, breaking settings seeding and any persisted state. Fixed by folding this path into the same chown-then-drop flow, targeting 999:999. Updates smoke.sh/assert-in-container.sh/ci.yml, which still encoded the pre-806b843 assumption that HOST_UID=0 stays root. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Push docker image to private registry.