Skip to content

security: sourcegraph/symbols container runs as `root`

Created by: slimsag

All of our Docker images inherit from sourcegraph/alpine which sets up a non-root sourcegraph user. However, a review by myself has shown this is not the case for the sourcegraph/symbols container. To confirm this I used the following:

$ docker run --entrypoint=sh -it sourcegraph/frontend:3.19.1 -c 'whoami'
sourcegraph

$ docker run --entrypoint=sh -it sourcegraph/symbols:3.19.1 -c 'whoami'
root

This is a non-critical security issue.