From 8ca37c277949282ae23320fcd0bb00bb4c61d298 Mon Sep 17 00:00:00 2001
From: Gianni Carafa <gianni.carafa@srf.ch>
Date: Sat, 11 Apr 2026 21:53:19 +0200
Subject: [PATCH 1/5] ignore dockerscan reports

---
 .gitignore | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index e16afa7..b82130e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,6 @@ node_modules
 VERSION
 output.css
 
-node_modules
\ No newline at end of file
+node_modules
+
+dockerscan-report.*
\ No newline at end of file

From bf46a81cd9ae7ce780faf8467701c07c082ba6fa Mon Sep 17 00:00:00 2001
From: Gianni Carafa <gianni.carafa@srf.ch>
Date: Sat, 11 Apr 2026 21:53:32 +0200
Subject: [PATCH 2/5] add health check

---
 Dockerfile              |  9 ++++++---
 cmd/healthcheck/main.go | 30 ++++++++++++++++++++++++++++++
 cmd/main.go             |  4 ++++
 3 files changed, 40 insertions(+), 3 deletions(-)
 create mode 100644 cmd/healthcheck/main.go

diff --git a/Dockerfile b/Dockerfile
index 95fdea3..5ff0745 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# Building the binary of the App
+# Build the binary of the App
 ARG VERSION=build
 
 FROM golang:1.26 AS build
@@ -9,15 +9,18 @@ COPY . .
 RUN go mod download
 
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-X ladder/handlers.version=${VERSION}" -o ladder cmd/main.go
+RUN CGO_ENABLED=0 GOOS=linux go build -o healthcheck cmd/healthcheck/main.go
 
+# Build the release image
 FROM gcr.io/distroless/static-debian13:nonroot AS release
 
 WORKDIR /app
 
 COPY --from=build /go/src/ladder/ladder .
+COPY --from=build /go/src/ladder/healthcheck .
 
-#EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD ["/app/healthcheck"]
 
-#ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+EXPOSE 8080
 
 ENTRYPOINT ["/app/ladder"]
\ No newline at end of file
diff --git a/cmd/healthcheck/main.go b/cmd/healthcheck/main.go
new file mode 100644
index 0000000..5638941
--- /dev/null
+++ b/cmd/healthcheck/main.go
@@ -0,0 +1,30 @@
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+func main() {
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	url := "http://127.0.0.1:" + port + "/healthz"
+	if len(os.Args) > 1 && os.Args[1] != "" {
+		url = os.Args[1]
+	}
+
+	client := http.Client{Timeout: 2 * time.Second}
+	res, err := client.Get(url)
+	if err != nil {
+		os.Exit(1)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < http.StatusOK || res.StatusCode >= http.StatusMultipleChoices {
+		os.Exit(1)
+	}
+}
diff --git a/cmd/main.go b/cmd/main.go
index 139bf2e..aa7a14b 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -97,6 +97,10 @@ func main() {
 		},
 	)
 
+	app.Get("/healthz", func(c *fiber.Ctx) error {
+		return c.SendStatus(fiber.StatusOK)
+	})
+
 	userpass := os.Getenv("USERPASS")
 	if userpass != "" {
 		userpass := strings.Split(userpass, ":")

From 2ae9b0e6b164a678e5dd898f0a0512dc8fea5634 Mon Sep 17 00:00:00 2001
From: Gianni Carafa <gianni.carafa@srf.ch>
Date: Sat, 11 Apr 2026 22:06:53 +0200
Subject: [PATCH 3/5] run in read-only

---
 docker-compose.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 2ffa9ab..3fb7b23 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,7 +1,7 @@
 version: '3'
 services:
   ladder:
-    image: ghcr.io/everywall/ladder:latest
+    image: ghcr.io/everywall/ladder:v0.0.22
     container_name: ladder
     build: .
     #restart: always
@@ -21,6 +21,9 @@ services:
       - LOG_URLS=true
       #- GODEBUG=netdns=go
       - FLARESOLVERR_HOST=http://flaresolverr:8191
+    read_only: true
+    tmpfs:
+      - /tmp
     ports:
       - "8080:8080"
     volumes:

From 693203b8d509c0cc4a0b76ad973cea830ef53527 Mon Sep 17 00:00:00 2001
From: Gianni Carafa <gianni.carafa@srf.ch>
Date: Sat, 11 Apr 2026 22:08:54 +0200
Subject: [PATCH 4/5]  Add capability drop for increased security in
 docker-compose configuration.

---
 docker-compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 3fb7b23..a9bd8e3 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -22,6 +22,8 @@ services:
       #- GODEBUG=netdns=go
       - FLARESOLVERR_HOST=http://flaresolverr:8191
     read_only: true
+    cap_drop:
+      - ALL
     tmpfs:
       - /tmp
     ports:

From dc5ac73aca03b25361ccd526a09cc620cb1cbc7a Mon Sep 17 00:00:00 2001
From: Gianni Carafa <gianni.carafa@srf.ch>
Date: Sat, 11 Apr 2026 22:17:50 +0200
Subject: [PATCH 5/5] add security options in docker-compose

---
 docker-compose.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index a9bd8e3..f96cfd2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,7 +1,6 @@
-version: '3'
 services:
   ladder:
-    image: ghcr.io/everywall/ladder:v0.0.22
+    image: ghcr.io/everywall/ladder:latest
     container_name: ladder
     build: .
     #restart: always
@@ -24,6 +23,9 @@ services:
     read_only: true
     cap_drop:
       - ALL
+    security_opt:
+      - apparmor:runtime/default
+      #- label:type:container_t  # SELinux alternative
     tmpfs:
       - /tmp
     ports: