Add `--read-only` flag to `docker run`

This flag further enhances security, however without further changes this flag will generate warnings because the `deno` executable needs to write twice: (1) to generate a dependency analysis cache, and (2) to generate a code cache.

(1) is resolved by adding a command to run `deno` once in the `Dockerfile`, to instantiate the analysis cache during image build.

(2) is resolved by adding `--no-code-cache` to the `deno run` command, which will avoid generating the code cache.

diff --git a/Dockerfile b/Dockerfile
index eb6093805883c2ebf91496b7b474210f0614049b..6ad46a969e1ce99779b767cd68c77286d3574705 100644 (file)
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
 FROM denoland/deno:alpine-2.3.5
 USER deno
+# Instantiate analysis cache to avoid console warnings later when running this image with the --read-only flag
+RUN deno
 COPY main.ts .
-CMD ["run", "main.ts"]
\ No newline at end of file
+CMD ["run", "--no-code-cache", "main.ts"]
\ No newline at end of file

diff --git a/README.md b/README.md
index 1218d77260d1505985a43d2cbd070ff9ca1f22ef..d810f505fb7823457d4ade3195da59c19aed8332 100644 (file)
--- a/README.md
+++ b/README.md
@@ -114,8 +114,8 @@ For additional security, you can run this CLI within a Docker container.
 docker build -t spt .
 ```
 
-2. Create a new container without network access and run the CLI:
+2. Create a new container with restrictive permissions and run the CLI:
 
 ```
-docker run -it --rm --network none spt
+docker run -it --rm --read-only --network none spt
 ```