Sicherheits-Härtung und Bugfixes

Dockerfile

@@ -1,29 +1,46 @@
 FROM python:3.12-slim
 
+ENV PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ffmpeg curl && \
     rm -rf /var/lib/apt/lists/*
 
+# Unprivilegierter Laufzeit-User (UID/GID per PUID/PGID zur Laufzeit anpassbar)
+RUN groupadd -g 1000 app && \
+    useradd -u 1000 -g app -M -d /nonexistent -s /usr/sbin/nologin app
+
 WORKDIR /app
 
 COPY bin/backend/requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install -r requirements.txt
 
+# Code bleibt root-gehörig und für den app-User schreibgeschützt
 COPY bin/backend/ /app/
 COPY bin/frontend/ /app/frontend/
 COPY bin/config.yml.dist /app/config.yml.dist
+COPY bin/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-RUN mkdir -p /app/data/recordings
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && \
+    chmod 755 /usr/local/bin/docker-entrypoint.sh && \
+    mkdir -p /app/data/recordings && \
+    chown -R app:app /app/data
 
 ARG APP_VERSION=dev
 ENV APP_VERSION=${APP_VERSION}
 ENV DATA_DIR=/app/data
 ENV STATIC_DIR=/app/frontend/static
-ENV PYTHONUNBUFFERED=1
+ENV PUID=1000 \
+    PGID=1000 \
+    RECORDING_ROOTS=/app/data/recordings:/recordings
 
 EXPOSE 8484
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -f http://localhost:8484/api/health || exit 1
 
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["python", "app.py"]