Docker hardening + SBOMs and provenance (#1065)

Author: rowan-baker

.github/workflows/push-docker.yaml

@@ -63,6 +63,8 @@ jobs:
         with:
           push: true
           file: docker/Dockerfile
+          provenance: mode=max
+          sbom: true
           tags: |
             surrealdb/surrealist:latest
             surrealdb/surrealist:${{ needs.version.outputs.version }}

.github/workflows/push-release.yaml

@@ -68,6 +68,8 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           file: docker/Dockerfile
+          provenance: mode=max
+          sbom: true
           tags: |
             surrealdb/surrealist:latest
             surrealdb/surrealist:${{ needs.version.outputs.version }}

docker/Dockerfile

@@ -24,9 +24,15 @@ RUN mkdir html
 WORKDIR /
 
 RUN rm /etc/nginx/conf.d/default.conf
+RUN addgroup -S surrealist && adduser -S -D -H -s /sbin/nologin -G surrealist surrealist
+RUN mkdir -p /var/cache/nginx /var/run/nginx /var/log/nginx \
+    && chown -R surrealist:surrealist /var/cache/nginx /var/run/nginx /var/log/nginx
 
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY ./docker/nginx/nginx.conf /etc/nginx
+RUN chown -R surrealist:surrealist /usr/share/nginx/html /etc/nginx
+
+USER surrealist
 
 EXPOSE 8080
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]

docker/nginx/nginx.conf

@@ -1,4 +1,4 @@
-user nginx;
+pid /var/run/nginx/nginx.pid;
 
 worker_processes    auto;
 
@@ -63,4 +63,4 @@ http {
         gzip_static     on;
         gunzip          on;
     }
-}
+}