Possible by not specifying a USER, a program in the container may run as 'root' in Dockerfile

[begininvoke]

This might be a false positive, but images/test_worker/Dockerfile around line 32 looked worth a second pair of eyes.

The Dockerfile does not set a non‑root USER, so the container's processes (including the CMD) run as root. This unnecessary privilege increases the impact of any compromise of the application – an attacker controlling a process could gain full container control. According to CWE‑250, execution with unnecessary privileges should be avoided.

The code in question

CMD $PY /opt/work_dir/handler.py

Something like this might fix it:

--- a/images/test_worker/Dockerfile
+++ b/images/test_worker/Dockerfile
@@ -4,6 +4,7 @@ FROM python:3.9-slim
 WORKDIR /opt/work_dir
 COPY . .
+USER appuser
 CMD $PY /opt/work_dir/handler.py

For reference: rule dockerfile.security.missing-user.missing-user, CWE-250 (Execution with Unnecessary Privileges). Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.