Intermediate
Stop running as root
A security audit flags the media service: its process runs as root, so a flaw in the app would hand an attacker root inside the container. Run it as an unprivileged user... and keep photo uploads working.
Photos are written to /app/uploads, kept in the named volume media-uploads. The test builds media/, runs it with -v media-uploads:/app/uploads, uploads a photo every two minutes and checks which user the process runs as.
What your server must hold
- No container of yours runs as root
- No failed write in the app
- Availability ≥ 99 %