Rostislav Dugin
17 lines
863 B
Plaintext
17 lines
863 B
Plaintext
# Trivy misconfiguration findings ignored for this repo.
|
|
# See: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/
|
|
#
|
|
# DS-0002 — "Specify at least 1 USER command in Dockerfile with non-root user as argument"
|
|
#
|
|
# Suppressed for `Dockerfile` because the structural check is a false
|
|
# positive for this image:
|
|
# - The final stage creates two non-root users (postgres UID 999,
|
|
# databasus UID 65532) and the main app process drops to non-root
|
|
# via `exec gosu databasus ./main` at the end of start.sh.
|
|
# - The entrypoint must start as root to:
|
|
# * Remap PUID/PGID at runtime (NAS / Synology / Unraid use case).
|
|
# * chown the mounted /databasus-data volume on first boot.
|
|
# * Run `initdb` on the embedded PostgreSQL data dir on first boot.
|
|
# - Adding a real `USER databasus` directive would break boot.
|
|
DS-0002
|