harden docker container

Author: Amelie-Artmann

Dockerfile

@@ -1,10 +1,22 @@
 FROM python:3.11-slim
 
+# create non-root user
+RUN useradd -m appuser
+
 WORKDIR /rag
 
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
+RUN chown -R appuser:appuser /rag
+
+# switch to non-root user
+USER appuser
+
+# healthcheck
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000')" || exit 1
+
 CMD ["python3", "-m", "app.api.testing_server"]

app/api/testing_server.py

@@ -154,4 +154,4 @@ def vote():
 
 if __name__ == "__main__":
     prepare_pairs()
-    app.run(host="0.0.0.0", port=5000, debug=True)
+    app.run(host="0.0.0.0", port=5000, debug=False)