build/Dockerfile.catalog (2)

44-54: ⚡ Quick win

Consider adding a non-root USER directive.

The container runs as root by default. Adding a non-root user improves security posture, especially if this image is used outside CI contexts.

OPM catalog images typically support running as non-root. The cache directory /tmp/cache should remain writable for non-root users.

🔒 Proposed fix to run as non-root

 FROM opm
 
 COPY --from=builder /configs /configs
 
 RUN ["/bin/opm", "serve", "/configs", "--cache-dir=/tmp/cache", "--cache-only"]
 
 LABEL operators.operatorframework.io.index.configs.v1=/configs
 
 EXPOSE 50051
+
+USER 1001
+
 ENTRYPOINT ["/bin/opm"]
 CMD ["serve", "/configs", "--cache-dir=/tmp/cache"]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build/Dockerfile.catalog` around lines 44 - 54, Add a non-root USER and
ensure runtime dirs are writable: create or switch to a dedicated unprivileged
user (e.g., "opmuser") in the Dockerfile, chown /tmp/cache and any config
directories copied from builder (referenced by COPY --from=builder /configs
/configs and the /tmp/cache used by RUN and CMD/ENTRYPOINT) to that user's
UID:GID, and add a USER instruction before ENTRYPOINT so the container runs
non-root while preserving write access to /tmp/cache and /configs.

---

14-16: 💤 Low value

Consider updating OPM to a more recent version.

OPM v1.23.0 is significantly outdated; the latest available version is v1.66.0. Updating would include numerous bug fixes, security improvements, and feature enhancements released over the intervening versions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build/Dockerfile.catalog` around lines 14 - 16, Update the OPM base image
version by changing the ARG OPM_VERSION value from v1.23.0 to a more recent
stable release (e.g., v1.66.0) so the FROM
quay.io/operator-framework/opm:${OPM_VERSION} AS opm stage pulls the newer OPM;
ensure any downstream compatibility tests are run after bumping ARG OPM_VERSION
to confirm no breaking changes.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

build/Dockerfile.catalog (1)

48-58: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add explicit non-root USER in the final stage.

Trivy flags this image as running as root (DS-0002). The opm base image does not guarantee a non-root USER across versions. To harden the image, pin a non-root UID and ensure /tmp/cache is writable for that user before switching.

Note: A previous review suggested this fix and marked it as addressed, but the directive appears to be missing from the current code.

🔒 Suggested hardening patch

 FROM opm
 
 COPY --from=builder /configs /configs
+RUN mkdir -p /tmp/cache && chown -R 65532:0 /configs /tmp/cache
+USER 65532
 
 RUN ["/bin/opm", "serve", "/configs", "--cache-dir=/tmp/cache", "--cache-only"]
 
 LABEL operators.operatorframework.io.index.configs.v1=/configs

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build/Dockerfile.catalog` around lines 48 - 58, Final Dockerfile stage
currently runs as root; add an explicit non-root user and ensure /tmp/cache is
writable before switching. In the final stage (the block that uses FROM opm,
COPY --from=builder, RUN ["/bin/opm", "serve", ...], ENTRYPOINT ["/bin/opm"],
CMD ["serve", ...]) create a dedicated user/group with a fixed UID/GID, mkdir
/tmp/cache and chown it to that user, and then add a USER instruction to switch
to that non-root account so the container runs non-root while preserving the
current ENTRYPOINT/CMD.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes