From 8c0d33a78c6e6d0d7846d9d77e956b0054f93215 Mon Sep 17 00:00:00 2001
From: Alexander <alexandr.shut@gmail.com>
Date: Wed, 15 Jul 2026 09:49:56 -0500
Subject: [PATCH] fix: drop gosu and setuptools from the image to clear scanner
 CVEs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The published image flagged Go stdlib CVEs (from the static gosu binary)
and jaraco.context (vendored inside setuptools). Neither is used at runtime.

- Replace gosu with setpriv (util-linux, already in the base image) for the
  root->proxui privilege drop in the entrypoint — no Go binary, no Go CVEs.
- pip-uninstall pip and setuptools after installing requirements, removing the
  vendored jaraco.context and shrinking the runtime attack surface.

Verified on a fresh build: image builds, serves HTTP 200, /app/data owned by
proxui, PID1 runs as uid 1000, and no Go binaries or jaraco remain.
---
 Dockerfile    | 7 ++++++-
 entrypoint.sh | 5 ++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 186cd1d..9bb9d59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,12 @@ WORKDIR /app
 COPY requirements.txt .
 
 RUN pip install --no-cache-dir -r requirements.txt && \
-    apt-get update && apt-get install -y --no-install-recommends curl gosu && \
+    # Drop pip/setuptools from the runtime image: not needed to run the app, and
+    # setuptools vendors jaraco.context which trips vulnerability scanners.
+    pip uninstall -y pip setuptools && \
+    # curl is for the HEALTHCHECK. gosu is intentionally omitted — entrypoint.sh
+    # uses setpriv (util-linux) to avoid pulling in a Go binary.
+    apt-get update && apt-get install -y --no-install-recommends curl && \
     rm -rf /var/lib/apt/lists/*
 
 # Labels
diff --git a/entrypoint.sh b/entrypoint.sh
index 7d35d2b..3807292 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -6,4 +6,7 @@ set -e
 mkdir -p /app/data
 chown -R proxui:proxui /app/data
 
-exec gosu proxui "$@"
+# Drop from root to the proxui user with setpriv (util-linux, already in the
+# base image) instead of gosu, which is a static Go binary that drags Go stdlib
+# CVEs into vulnerability scans despite not using those code paths.
+exec setpriv --reuid proxui --regid proxui --init-groups "$@"