fix(docker): create .ssh dir explicitly, ensure entrypoint is executable

fix(docker): move SSH host key path into /data for non-root user
fix(docker): non-root user, supply chain attestations, build cleanup
2026-06-01 15:56:45 -04:00 · 2026-06-01 15:33:52 -04:00 · 2026-06-01 11:46:05 -04:00 · 2026-05-30 23:34:56 +00:00 · 2026-05-29 20:51:40 -04:00 · 2026-05-30 00:33:20 +00:00
5 changed files with 39 additions and 7 deletions
@@ -66,6 +66,8 @@ jobs:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
+          sbom: true
+          provenance: mode=max
          tags: |
            lerkolabs/uptop:${{ github.ref_name }}
            lerkolabs/uptop:latest
@@ -73,3 +75,16 @@ jobs:
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
+
+      - name: Update Docker Hub description
+        uses: peter-evans/dockerhub-description@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: lerkolabs/uptop
+
+      - name: Cleanup Docker artifacts
+        if: always()
+        run: |
+          docker image prune -f
+          docker builder prune -f --keep-storage=2GB
@@ -17,18 +17,21 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 # --- Stage 2: Runner ---
 FROM alpine:3.23
 WORKDIR /app
-RUN apk add --no-cache ca-certificates openssh-client
-RUN mkdir /data
+RUN apk add --no-cache ca-certificates && apk upgrade --no-cache
+RUN addgroup -g 1000 -S uptop && adduser -u 1000 -S uptop -G uptop
+RUN mkdir -p /data/.ssh && chown -R uptop:uptop /data

 COPY --from=builder /app/uptop .
+COPY --chmod=755 docker-entrypoint.sh /usr/local/bin/

-# Set Default Configuration via ENV
-# Docker users can override these in docker-compose.yml
 ENV LIPGLOSS_RENDERER_HAS_DARK_BACKGROUND=true
 ENV UPTOP_DB_TYPE=sqlite
 ENV UPTOP_DB_DSN=/data/uptop.db
 ENV UPTOP_KEYS=/data/authorized_keys
+ENV UPTOP_SSH_HOST_KEY=/data/.ssh/id_ed25519
 ENV UPTOP_PORT=23234

 EXPOSE 23234
+USER uptop
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["./uptop"]
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+if [ ! -w /data ]; then
+    echo "ERROR: /data is not writable by uptop user (UID $(id -u))." >&2
+    echo "" >&2
+    echo "If upgrading from a previous version that ran as root:" >&2
+    echo "  docker run --rm -v <your_volume>:/data alpine chown -R 1000:1000 /data" >&2
+    exit 1
+fi
+
+mkdir -p /data/.ssh
+
+exec "$@"
@@ -53,7 +53,7 @@ require (
 	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
@@ -107,8 +107,8 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
Author	SHA1	Message	Date
lerko	8d34524aa0	fix(docker): create .ssh dir explicitly, ensure entrypoint is executable CI / test (pull_request) Successful in 2m31s Details CI / lint (pull_request) Successful in 1m6s Details CI / vulncheck (pull_request) Successful in 1m6s Details	2026-06-01 15:56:45 -04:00
lerko	b254f6ea05	fix(docker): move SSH host key path into /data for non-root user CI / test (pull_request) Successful in 2m26s Details CI / lint (pull_request) Successful in 40s Details CI / vulncheck (pull_request) Successful in 41s Details	2026-06-01 15:33:52 -04:00
lerko	87270490de	fix(docker): non-root user, supply chain attestations, build cleanup CI / test (pull_request) Successful in 2m29s Details CI / lint (pull_request) Successful in 46s Details CI / vulncheck (pull_request) Successful in 41s Details BREAKING: Container now runs as UID 1000 (uptop) instead of root. Existing volumes with root-owned files need migration: docker run --rm -v <volume>:/data alpine chown -R 1000:1000 /data - Add uptop user (UID/GID 1000) with entrypoint writability check - Enable SBOM and provenance attestations for Docker Scout compliance - Prune dangling images and build cache after release builds	2026-06-01 11:46:05 -04:00
lerko	f80e519349	Merge pull request 'ci: sync README to Docker Hub on release' (#43 ) from ci/dockerhub-readme into main CI / test (push) Successful in 2m25s Details CI / lint (push) Successful in 40s Details CI / vulncheck (push) Successful in 31s Details Release / release (push) Successful in 2m8s Details Release / docker (push) Successful in 20m7s Details Reviewed-on: #43	2026-05-30 23:34:56 +00:00
lerko	9a4a53f487	ci: sync README to Docker Hub on release CI / test (pull_request) Successful in 2m23s Details CI / lint (pull_request) Successful in 51s Details CI / vulncheck (pull_request) Successful in 41s Details Use peter-evans/dockerhub-description to push README.md as the Docker Hub repository overview after each image build.	2026-05-29 20:51:40 -04:00
lerko	32982228b0	fix(security): patch Docker Scout CVEs and remove unused openssh-client (#41 ) CI / test (push) Successful in 2m34s Details CI / lint (push) Successful in 46s Details CI / vulncheck (push) Successful in 40s Details ## Summary - Upgrade `golang.org/x/net` v0.54.0 → v0.55.0 — patches 6 CVEs including critical CVE-2026-41589 (CVSS 9.6) - Remove `openssh-client` from Docker image — unused (uptop uses pure Go SSH), eliminates 4 CVEs - Add `apk upgrade` to Dockerfile for remaining Alpine package CVEs ## CVEs Resolved \| CVE \| Severity \| Package \| Fix \| \|-----\|----------\|---------\|-----\| \| CVE-2026-41589 \| 9.6 Critical \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2025-60876 \| 6.5 Medium \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2026-42502 \| 6.1 Medium \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2026-42506 \| 6.1 Medium \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2026-25681 \| 6.1 Medium \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2026-35414 \| 6.1 Medium \| golang.org/x/net \| upgraded to v0.55.0 \| \| CVE-2026-25680 \| 7.5 High \| alpine/openssh \| removed openssh-client \| \| CVE-2026-35386 \| 3.6 Low \| alpine/openssh \| removed openssh-client \| \| CVE-2026-35387 \| 3.1 Low \| alpine/openssh \| removed openssh-client \| \| CVE-2026-35388 \| 2.5 Low \| alpine/openssh \| removed openssh-client \| \| CVE-2026-27136 \| 6.5 Medium \| alpine/busybox \| apk upgrade \| ## Not Addressed (not exploitable) CVE-2026-35385 (charmbracelet/wish v1.4.7, CVSS 9.6) — path traversal in wish's SCP middleware. uptop does not use the SCP middleware, only wish core + bubbletea middleware. Vulnerable code path is never loaded. Migration to wish v2 tracked in #42. ## Test Plan - [x] `go build ./...` passes - [x] `go test ./...` passes - [ ] Rebuild Docker image, re-scan with Docker Scout Reviewed-on: #41	2026-05-30 00:33:20 +00:00