Lucas RayanandClaude Sonnet 5.5
931ddcd004
O scan Trivy do CI falhou no push anterior e impediu a publicacao das imagens, entao a producao seguiu na versao antiga. - webmail: next 15.5.21 -> 15.5.27 (RCE no otimizador de imagens e cache poisoning), sharp -> 0.35.5, source-map-js -> 1.2.2, dompurify -> 3.4.17 - protocols: golang.org/x/net 0.58 -> 0.60 (DoS HTTP/2) e toolchain Go 1.25 -> 1.26 (stdlib corrigida a partir de 1.26.9) Verificado localmente: imagens e repositorio sem achados HIGH/CRITICAL, testes e build verdes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
32 lines
1.1 KiB
Docker
32 lines
1.1 KiB
Docker
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -o /out/lambdamail-protocols ./cmd/lambdamail-protocols
|
|
|
|
FROM alpine:3.20
|
|
# libcap provides setcap and is dropped again once the capability is set.
|
|
RUN apk add --no-cache ca-certificates libcap
|
|
|
|
COPY --from=build /out/lambdamail-protocols /app/lambdamail-protocols
|
|
|
|
# This process terminates SMTP from the open internet, so it must not run as
|
|
# root (PLAN.md section 17, risk R5). Every mail port it binds is below 1024,
|
|
# which normally requires root - the file capability grants exactly that one
|
|
# privilege to this one binary instead.
|
|
RUN setcap 'cap_net_bind_service=+ep' /app/lambdamail-protocols \
|
|
&& apk del libcap
|
|
|
|
RUN addgroup -g 10001 -S lambdamail \
|
|
&& adduser -u 10001 -S -G lambdamail lambdamail \
|
|
# Created here so a fresh named volume mounted at this path inherits the
|
|
# ownership: Docker seeds an empty volume from the image directory.
|
|
&& mkdir -p /var/lambdamail/spool \
|
|
&& chown -R lambdamail:lambdamail /var/lambdamail
|
|
|
|
USER lambdamail:lambdamail
|
|
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/app/lambdamail-protocols"]
|