WuYongJie/gongxiangp2
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(security): 收紧容器运行文件权限

Browse Source
This commit is contained in:
chenpei 2026-07-30 22:49:09 +08:00
parent b48872d83b
commit 69c2c62be3
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Dockerfile
View File

@ -103,15 +103,19 @@ COPY --from=builder --chown=nextjs:nodejs /app/lib ./lib
COPY --from=builder --chown=nextjs:nodejs /app/scripts/public-traffic-rollup-from-nginx.py ./scripts/public-traffic-rollup-from-nginx.py
COPY --from=builder --chown=nextjs:nodejs /app/scripts/collapse-performance-survey-template-versions.mjs ./scripts/collapse-performance-survey-template-versions.mjs
# 创建必要目录并设置权限
# 创建必要目录并收紧权限。
# 应用代码归 root 所有，运行账号只能写上传目录和 Next.js 运行时缓存；
# 即使上层文件路径校验再次出现缺陷，也不能覆盖 server.js 或业务源码。
RUN mkdir -p /app/public /app/uploads && \
mkdir -p /app/scripts && \
mkdir -p /app/.next/cache && \
mkdir -p /app/uploads/temp && \
mkdir -p /app/uploads/assembled && \
mkdir -p /app/uploads/materials && \
mkdir -p /app/uploads/cleanup && \
chown -R nextjs:nodejs /app/public /app/uploads && \
chmod -R 777 /app/uploads
chown -R root:root /app && \
chown -R nextjs:nodejs /app/.next/cache /app/uploads && \
chmod 0750 /app/uploads /app/uploads/temp /app/uploads/assembled /app/uploads/materials /app/uploads/cleanup
USER nextjs