From c71df72c824d54df29e3183ac44fa1f1cf2606ed Mon Sep 17 00:00:00 2001 From: Ardis Lu Date: Sun, 8 Jun 2025 19:32:03 -0700 Subject: [PATCH] Add `--read-only` flag to `docker run` This flag further enhances security, however without further changes this flag will generate warnings because the `deno` executable needs to write twice: (1) to generate a dependency analysis cache, and (2) to generate a code cache. (1) is resolved by adding a command to run `deno` once in the `Dockerfile`, to instantiate the analysis cache during image build. (2) is resolved by adding `--no-code-cache` to the `deno run` command, which will avoid generating the code cache. --- Dockerfile | 4 +++- README.md | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index eb60938..6ad46a9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,6 @@ FROM denoland/deno:alpine-2.3.5 USER deno +# Instantiate analysis cache to avoid console warnings later when running this image with the --read-only flag +RUN deno COPY main.ts . -CMD ["run", "main.ts"] \ No newline at end of file +CMD ["run", "--no-code-cache", "main.ts"] \ No newline at end of file diff --git a/README.md b/README.md index 1218d77..d810f50 100644 --- a/README.md +++ b/README.md @@ -114,8 +114,8 @@ For additional security, you can run this CLI within a Docker container. docker build -t spt . ``` -2. Create a new container without network access and run the CLI: +2. Create a new container with restrictive permissions and run the CLI: ``` -docker run -it --rm --network none spt +docker run -it --rm --read-only --network none spt ``` -- 2.47.3