[GH-ISSUE #865] Improve security of container images - run as non-root, read-only root file system, etc #562

New issue

Open

opened 2026-03-02 11:50:54 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 11:50:54 +03:00

Owner

Originally created by @ItalyPaleAle on GitHub (Jan 12, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/865

Describe the Bug

Looking at the code for the Dockerfile and the official docker-compose, there seems to be a couple of things that could be improved for better security:

Whenever possible, it'd be better if containers could run as non-root. Today, the hoarder container seems to be using the root user inside. This should ideally be configurable with the uid and gid options in the docker-compose
Ideally the root filesystem of the container should not be writable, so only the (mounted) volumes can be written to. This is configured by setting read_only in the docker-compose

Steps to Reproduce

Run Hoarder as Docker container

Expected Behaviour

Some best practices for security should be implemented by default

Screenshots or Additional Context

No response

Device Details

No response

Exact Hoarder Version

0.21.0

Have you checked the troubleshooting guide?

I have checked the troubleshooting guide and I haven't found a solution to my problem

Originally created by @ItalyPaleAle on GitHub (Jan 12, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/865 ### Describe the Bug Looking at the code for the [Dockerfile](https://github.com/hoarder-app/hoarder/blob/main/docker/Dockerfile) and the official [docker-compose](https://github.com/hoarder-app/hoarder/blob/main/docker/docker-compose.yml), there seems to be a couple of things that could be improved for better security: - Whenever possible, it'd be better if containers could run as non-root. Today, the hoarder container seems to be using the root user inside. This should ideally be configurable with the `uid` and `gid` options in the [docker-compose](https://github.com/compose-spec/compose-spec/blob/main/spec.md#long-syntax) - Ideally the root filesystem of the container should not be writable, so only the (mounted) volumes can be written to. This is configured by setting [read_only](https://github.com/compose-spec/compose-spec/blob/main/spec.md#read_only) in the docker-compose ### Steps to Reproduce 1. Run Hoarder as Docker container ### Expected Behaviour 1. Some best practices for security should be implemented by default ### Screenshots or Additional Context _No response_ ### Device Details _No response_ ### Exact Hoarder Version 0.21.0 ### Have you checked the troubleshooting guide? - [X] I have checked the troubleshooting guide and I haven't found a solution to my problem

kerem commented

2026-03-02 11:50:55 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jan 12, 2025):

Regarding running as non root, we're tracking this in #606. As for having a read only FS, we relay on temp files for a lot of things, which I think wouldn't make this possible?

@MohamedBassem commented on GitHub (Jan 12, 2025): Regarding running as non root, we're tracking this in #606. As for having a read only FS, we relay on temp files for a lot of things, which I think wouldn't make this possible?

kerem commented

2026-03-02 11:50:55 +03:00

Author

Owner

@ItalyPaleAle commented on GitHub (Jan 12, 2025):

Thanks for the quick response!

For read-only root, it could maybe be done in conjunction with a temp fs? https://docs.docker.com/reference/compose-file/services/#tmpfs

@ItalyPaleAle commented on GitHub (Jan 12, 2025): Thanks for the quick response! For read-only root, it could maybe be done in conjunction with a temp fs? https://docs.docker.com/reference/compose-file/services/#tmpfs