fix(docker): resolve KICS alerts on lido-governance-monitor Dockerfile#3526
Merged
Conversation
Address the 11 open KICS findings on the lido-governance-monitor Dockerfile. KICS scan is currently disabled (.github/workflows/dockerfile-security-scan.yml) due to the Checkmarx supply-chain compromise, so these alerts no longer auto-close. Genuine fixes: - Pin corepack to 0.35.0 instead of @latest (NPM Install Without Pinned Version) - Drop --chown=node:node on runtime COPYs so files stay root-owned; the node user only needs read/execute and root ownership prevents tampering (Chown Flag Exists) Suppressed with kics-scan ignore-line + documented justification: - apt-get install (ca-certificates, bash, curl, openssl): not pinned; versions track the node:slim base image and pinning would break builds on base refresh for negligible gain (Apt Get Install Pin Version Not Defined) - pnpm install --frozen-lockfile: versions are pinned by pnpm-lock.yaml; this is a workspace install, not a single-package add (NPM Install Without Pinned Version) - HEALTHCHECK: not applicable, this image is a one-shot batch job (run.ts exits after a single execution), not a long-running server (Healthcheck Instruction Missing) Co-authored-by: Cursor <cursoragent@cursor.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
eloi010
self-requested a review
July 7, 2026 11:35
… migrate The previous commit dropped --chown=node:node on runtime COPYs, leaving all of node_modules root-owned. That broke the production init container, which runs `prisma migrate deploy` before app start (docs/db-migration.md): prisma extracts the schema-engine binary into node_modules/.pnpm/@prisma+engines@*/.../engines on first run and needs write access there. With root ownership, migrate deploy fails with "Can't write to .../@prisma/engines" and the pod will not start. Fix: keep runtime files root-owned (security benefit + KICS Chown alerts resolved) but chown only the prisma engines subdir to node via RUN chown. KICS "Chown Flag Exists" targets the COPY --chown flag, not RUN chown, so this does not re-trigger the rule. Verified locally: - Image builds; prisma migrate deploy from the container as the node user now succeeds against the test DB (was failing). - dist/run.js stays root-owned; engines dir and prisma cache are node-owned. - App boots to expected config validation; jest suite still passes (229 tests). Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
E2E validation updateRan the full README "E2E Local Test" pipeline against live APIs inside the production container (with the Dockerfile changes from this PR) to confirm the runtime changes don't break the pipeline. Scope reduction (cost control): Result: full pipeline passes end-to-end, exit 0.
Pre-existing app issues found (NOT related to this Dockerfile PR - flagging for a separate issue):
No Dockerfile/runtime regressions. The |
Three changes from code review: - corepack: `npm i` -> `npm install` (KICS only whitelists the literal word `install`, not the `i` alias, so the finding survived the pin) - HEALTHCHECK: replace `kics-scan ignore-line` on the production FROM with an explicit `HEALTHCHECK NONE` near CMD; ignore-line would also silence any future rules anchored to that FROM line, and NONE is the correct declaration for a one-shot batch job anyway - apt pinning: replace two per-block `kics-scan ignore-line` comments with a single file-global `kics-scan disable=965a08d7-...` at the top of the file, so other apt checks (--no-install-recommends, list cleanup) remain active Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the 11 open KICS code-scanning alerts on
operations/native-yield/lido-governance-monitor/Dockerfile(alert query).The KICS workflow is currently disabled (
.github/workflows/dockerfile-security-scan.yml,if: false) due to the Checkmarx/KICS supply-chain compromise (2026-04-22), so these alerts no longer auto-close on re-scan. Stale alerts are dismissed via the code-scanning API with reasons referencing this PR.Alert handling
corepack@0.35.0(was@latest)--chown=node:nodeon runtimeCOPYs; files stay root-owned (node user only needs read/execute; prevents tampering)kics-scan ignore-line): packages tracknode:slim; pinning breaks builds on base refresh for negligible gainpnpm install --frozen-lockfilepins versions viapnpm-lock.yaml(false positive)run.tsexits after a single execution), not a long-running server; HEALTHCHECK N/ANotes
/home/node/.cache/prisma) is stillchown'd tonodesince it is written at runtime; only the read-only runtime files (dist, prompts, migrations) are root-owned.automation-service,postman) share the same patterns but are intentionally out of scope for this PR.Test plan
docker buildagainst the updated Dockerfile)nodeuserMade with Cursor