ensure ca-certificates.crt is read only (#326) (#327)

apigee · Sep 13, 2021 · 1e7bb20 · 1e7bb20
1 parent a9bbd5c
commit 1e7bb20
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -44,6 +44,9 @@ RUN CGO_ENABLED=$CGO_ENABLED go build -a \
 RUN groupadd -g 999 apigee && \
     useradd -r -u 999 -g apigee apigee
 
+# remove all write privileges from ca-certificates.crt
+RUN chmod 4444 /etc/ssl/certs/ca-certificates.crt
+
 #--- Build runtime container ---#
 FROM ${RUN_CONTAINER}