replace runtime image bonfire to distrolles run as noroot

revoltchat · Dec 7, 2023 · 62a72ae · 62a72ae
1 parent c152ed2
commit 62a72ae
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/crates/bonfire/Dockerfile b/crates/bonfire/Dockerfile
@@ -2,10 +2,14 @@
 FROM ghcr.io/revoltchat/base:latest AS builder
 
 # Bundle Stage
-FROM debian:bullseye-slim
-RUN apt-get update && \
-    apt-get install -y ca-certificates && \
-    apt-get clean
+FROM gcr.io/distroless/cc:nonroot
+
+# copy our compiled binary
 COPY --from=builder /home/rust/src/target/release/revolt-bonfire ./
 EXPOSE 9000
+
+# run as non-privileged user
+USER nonroot
+
+# command of container
 CMD ["./revolt-bonfire"]