From 2fd3c801deecffad0bd8020a44c54dbd750a7ab0 Mon Sep 17 00:00:00 2001
From: Ryan Cavicchioni <ryan@cavi.cc>
Date: Wed, 30 Apr 2025 16:40:58 -0500
Subject: [PATCH] ensure that the application is not writable by kubernaut

---
 dockerfiles/alpine.Dockerfile   | 8 ++++----
 dockerfiles/bookworm.Dockerfile | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/dockerfiles/alpine.Dockerfile b/dockerfiles/alpine.Dockerfile
index 2187921..5d9bfc2 100644
--- a/dockerfiles/alpine.Dockerfile
+++ b/dockerfiles/alpine.Dockerfile
@@ -30,6 +30,8 @@ RUN <<EOT
   rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
 EOT
 
+COPY . .
+
 FROM base
 
 ENV PORT=4567
@@ -39,12 +41,10 @@ RUN <<EOT
   adduser --system --uid 666 --ingroup kubernaut --shell /bin/bash --disabled-password kubernaut
 EOT
 
-USER kubernaut:kubernaut
-
 COPY --from=build /usr/local/bundle /usr/local/bundle
-COPY --from=build --chown=kubernaut:kubernaut /kubernaut /kubernaut
+COPY --from=build /kubernaut /kubernaut
 
-COPY --chown=kubernaut:kubernaut . .
+USER kubernaut:kubernaut
 
 EXPOSE $PORT
 ENTRYPOINT [ "/kubernaut/dockerfiles/entrypoint.sh" ]
diff --git a/dockerfiles/bookworm.Dockerfile b/dockerfiles/bookworm.Dockerfile
index da970c6..fee1c30 100644
--- a/dockerfiles/bookworm.Dockerfile
+++ b/dockerfiles/bookworm.Dockerfile
@@ -30,6 +30,8 @@ RUN <<EOT
   rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
 EOT
 
+COPY . .
+
 FROM base
 
 ENV PORT=4567
@@ -39,12 +41,10 @@ RUN <<EOT
   useradd --system --uid 666 --gid kubernaut --create-home --shell /bin/bash kubernaut
 EOT
 
-USER kubernaut:kubernaut
-
 COPY --from=build /usr/local/bundle /usr/local/bundle
-COPY --from=build --chown=kubernaut:kubernaut /kubernaut /kubernaut
+COPY --from=build /kubernaut /kubernaut
 
-COPY --chown=kubernaut:kubernaut . .
+USER kubernaut:kubernaut
 
 EXPOSE $PORT
 ENTRYPOINT [ "/kubernaut/dockerfiles/entrypoint.sh" ]