Skip to content

fix(security): run OPEA microservices as non-root user

Jérôme Revillard requested to merge worktree-fix-dockerfile-root into main

Summary

  • Add non-root user to all 4 OPEA Dockerfiles (dataprep, retriever, reranker, ChatQnA) following the principle of least privilege
  • Move EasyOCR models from /root/.EasyOCR/ to /home/user/.EasyOCR/ in dataprep
  • Add chown -R user:user /app /home/user and USER user directive before CMD/ENTRYPOINT in each Dockerfile

Context

Resolves #503 (closed)

All 4 Docker images build successfully as non-root.

Test plan

  • docker compose build dataprep-arango-service passes
  • docker compose build retriever-arango-service passes
  • docker compose build reranker passes
  • docker compose build chatqna-xeon-backend-server passes
  • Verify containers start correctly as non-root in a full deployment

Merge request reports