From f0ca202f0268fc08dd981753e0dd234ecd99d9b4 Mon Sep 17 00:00:00 2001 From: karen-nix Date: Thu, 13 Aug 2026 09:16:49 -0500 Subject: [PATCH] Update Dockerfile Addition of WORKDIR /, see https://docs.docker.com/build/building/best-practices/#workdir. And addition of non-root user to exercise least privilege, see https://docs.docker.com/build/building/best-practices/#user. --- docker/ubuntu/Dockerfile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docker/ubuntu/Dockerfile b/docker/ubuntu/Dockerfile index d6c82eb..0d1865b 100644 --- a/docker/ubuntu/Dockerfile +++ b/docker/ubuntu/Dockerfile @@ -11,6 +11,14 @@ ARG LLVM_VERSION=20 ENV DEBIAN_FRONTEND=noninteractive +WORKDIR / + +RUN groupadd -r user && \ + useradd -r -g user -m -d /home/user -s /bin/bash user + +USER user +WORKDIR /user + # Build tooling + clang/LLVM pinned from apt.llvm.org. g++ is installed so the # address/undefined jobs (which use clang with the default libstdc++) have the # standard library headers available.