Remove SUID/SGID bits to harden image security (#188)

Author: smortexa

FrankenPHP.Alpine.Dockerfile

@@ -153,7 +153,8 @@ RUN composer dump-autoload \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}
 

FrankenPHP.Dockerfile

@@ -157,7 +157,8 @@ RUN composer dump-autoload \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}
 

RoadRunner.Alpine.Dockerfile

@@ -141,7 +141,8 @@ RUN if composer show | grep spiral/roadrunner-cli >/dev/null; then \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}
 

RoadRunner.Dockerfile

@@ -145,7 +145,8 @@ RUN if composer show | grep spiral/roadrunner-cli >/dev/null; then \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}
 

Swoole.Alpine.Dockerfile

@@ -136,7 +136,8 @@ RUN composer dump-autoload \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}
 

Swoole.Dockerfile

@@ -140,7 +140,8 @@ RUN composer dump-autoload \
 
 RUN bun run build
 
-RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT}
+RUN chown -R ${USER_ID}:${GROUP_ID} ${ROOT} \
+    && find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true
 
 USER ${USER}