mirror/firmware
1
0 Fork 0
mirror of https://github.com/meshtastic/firmware.git synced 2026-10-10 23:56:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

lint: suppress intentional root USER in runtime Dockerfiles (#11166)

Browse Source 
meshtasticd must run as root to reach GPIO/I2C/SPI hardware, so the final
USER root is deliberate. The existing file-level ignore used the old trivy
code (DS002); rename it to DS-0002 and add checkov/CKV_DOCKER_8 so the
last-USER-root findings are suppressed with an explicit justification.
This commit is contained in:
Jorropo authored and GitHub committed 2026-07-24 08:28:21 +00:00
1 parent 419e8ee11f
commit ee74c3c446
2 files changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Dockerfile
+2 -1
View File
@@ -1,4 +1,5 @@
# trunk-ignore-all(trivy/DS002): We must run as root for this container
# trunk-ignore-all(trivy/DS-0002): We must run as root for this container
# trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container
# trunk-ignore-all(hadolint/DL3002): We must run as root for this container
# trunk-ignore-all(hadolint/DL3008): Do not pin apt package versions
# trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions
alpine.Dockerfile
+2 -1
View File
@@ -1,4 +1,5 @@
# trunk-ignore-all(trivy/DS002): We must run as root for this container
# trunk-ignore-all(trivy/DS-0002): We must run as root for this container
# trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container
# trunk-ignore-all(hadolint/DL3002): We must run as root for this container
# trunk-ignore-all(hadolint/DL3018): Do not pin apk package versions
# trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions