Invental/Review lessons/Trust boundaries the server must hold

Trust boundaries the server must hold

Start-up scripts must not be world-writable

Anything a container runs later (hooks, entrypoints, cron scripts) must not be writable by the users who run inside it. chmod 777 in a Dockerfile turns “install script” into “anyone's script”.

01 · Before and afterThe pattern

Dockerfile
# before: every user in the container can rewrite scripts that run on start
COPY --from=src /plugins/x /opt/plugins/x
RUN chmod -R 0777 /opt/plugins/x && /opt/plugins/x/install.sh

# after: owned by root, readable and executable by all, writable by root only
COPY --chown=root:root --from=src /plugins/x /opt/plugins/x
RUN chmod -R 0755 /opt/plugins/x && /opt/plugins/x/install.sh

02 · Run it on your appThe check

Does any script that your container runs at start-up live in a folder that a non-root user can write to?

If the honest answer is no or not sure, this is worth a look before it reaches production.

Want this checked on your code?

Tell us what you are building and what worries you. We match a senior reviewer to your code and confirm scope before anything starts.

— Get in touch
hi@invental.co ↗
— Or
— What to include

A link or short description of the code or system, what you want checked, your stack, and when you need the answer. No repository access is needed until scope is agreed.

— Or leave a note
We reply within one business day.