SecOps #206: [Sécurité] Vulnérabilité de code : Dockerfile:25 (dockerfile.security.missing-user.missing-user) - Pipeliner Client - Redmine

Actions

SecOps #206

closed

CD

[Sécurité] Vulnérabilité de code : Dockerfile:25 (dockerfile.security.missing-user.missing-user)

SecOps #206: [Sécurité] Vulnérabilité de code : Dockerfile:25 (dockerfile.security.missing-user.missing-user)

Added by Client Dashboard about 2 months ago. Updated about 2 months ago.

Status:

Shipped

Priority:

Normal

Assignee:

-

Start date:

06/15/2026

Due date:

% Done:

0%

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

Dockerfile:25_dockerfile.security.missing-user.missing-user

severity:

high

paused:

Description

**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : Dockerfile:25
**Règle** : dockerfile.security.missing-user.missing-user

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

### Extrait de code
```
requires login
```

### Lien CVE
https://owasp.org/Top10/A04_2021-Insecure_Design

### Recommandations
USER non-root
CMD ["node", "server.js"]

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#1

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#2

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#3

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#4

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#5

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#6

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

CD Updated by Client Dashboard about 2 months ago Actions
Copy link
#7

Vulnérabilité `Dockerfile:25_dockerfile.security.missing-user.missing-user` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).

RA Updated by Redmine Admin about 2 months ago Actions
Copy link
#8

Status changed from Submitted to In development

Claiming → In development. Fix: run the frontend container as the non-root `node` user (add USER + chown in the runner stage of the root Dockerfile). Verified the finding is real: Dockerfile:25 CMD runs with no prior USER (root).

RA Updated by Redmine Admin about 2 months ago Actions
Copy link
#9

Status changed from In development to Shipped

Deployed to production (master build #80: Promote images → Deploy prod → Migrate prod, all green; prod healthy, app 307 / api 200). Frontend container now runs as non-root `node` (uid 1000) — verified the image boots Next standalone non-root locally AND the prod deploy succeeded. Semgrep dockerfile.security.missing-user (Dockerfile:25) resolved. Closing → Shipped.

Actions

Also available in: PDF Atom