Files

T

cgalo5758 8e7e0dd04d Harden container, OIDC auth, and error handling

Run Docker runtime stage as non-root user app (UID 65532).

Add styled full-page 404/500 error rendering for navigation requests
while preserving plain-text responses for HTMX partials.

Reuse recent unconsumed OIDC login state to avoid state mismatch on
parallel login hits, and merge resource_access in role extraction.

Re-level template headings, add autocomplete tokens, and resolve
catalog resource display names.

Self-label test-stack secrets and document CSRF secret rotation.

2026-07-31 23:27:15 -05:00

821 B

Raw Blame History

container-image Specification

Purpose

Define the security posture of the shipped application container image, starting with running the application process as a dedicated non-root user.

Requirements

Requirement: Runtime container executes as non-root

The application container image SHALL run the application process as a dedicated non-root user.

Scenario: Container process has a non-zero UID

WHEN the image is built and a container is started from it with no user override
THEN the application process SHALL run with a non-zero UID

Scenario: Application serves normally as non-root

WHEN the container runs as the non-root user
THEN the application SHALL bind port 8080 and serve requests
AND no operation SHALL fail with a filesystem or port permission error

821 B Raw Blame History