From d4ddb0dc97eee360c92283d6a3aaa9fd95808e37 Mon Sep 17 00:00:00 2001 From: karen-nix Date: Thu, 13 Aug 2026 09:44:52 -0500 Subject: [PATCH] Update Dockerfile Addition of --no-install-recommends to line 2, see https://docs.docker.com/build/building/best-practices/#use---pull-to-get-fresh-base-images as well as addition of non-root user to exercise least privilege, see https://docs.docker.com/build/building/best-practices/#user. Plus, healthcheck instruction addition, line 13, see https://docs.docker.com/reference/dockerfile/#healthcheck --- .clusterfuzzlite/Dockerfile | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile index d3f2293..9ebf782 100644 --- a/.clusterfuzzlite/Dockerfile +++ b/.clusterfuzzlite/Dockerfile @@ -1,6 +1,13 @@ FROM gcr.io/oss-fuzz-base/base-builder -RUN apt-get update && apt-get install -y make autoconf automake libtool +RUN apt-get update && apt-get install -y --no-install-recommends make autoconf automake libtool COPY . $SRC/json_struct COPY .clusterfuzzlite/build.sh $SRC/build.sh -WORKDIR $SRC/json_struct \ No newline at end of file +WORKDIR $SRC/json_struct + +RUN groupadd -r user && \ + useradd -r -g user -m -d /home/user -s /bin/bash user + +USER user + +HEALTHCHECK --interval=5m --timeout=3s \