Feature/docker image hardening

.gitignore

@@ -5,4 +5,6 @@ node_modules
 VERSION
 output.css
 
-node_modules
+node_modules
+
+dockerscan-report.*

Dockerfile

@@ -1,4 +1,4 @@
-# Building the binary of the App
+# Build the binary of the App
 ARG VERSION=build
 
 FROM golang:1.26 AS build
@@ -9,15 +9,18 @@ COPY . .
 RUN go mod download
 
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-X ladder/handlers.version=${VERSION}" -o ladder cmd/main.go
+RUN CGO_ENABLED=0 GOOS=linux go build -o healthcheck cmd/healthcheck/main.go
 
+# Build the release image
 FROM gcr.io/distroless/static-debian13:nonroot AS release
 
 WORKDIR /app
 
 COPY --from=build /go/src/ladder/ladder .
+COPY --from=build /go/src/ladder/healthcheck .
 
-#EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD ["/app/healthcheck"]
 
-#ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+EXPOSE 8080
 
 ENTRYPOINT ["/app/ladder"]

cmd/healthcheck/main.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+func main() {
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	url := "http://127.0.0.1:" + port + "/healthz"
+	if len(os.Args) > 1 && os.Args[1] != "" {
+		url = os.Args[1]
+	}
+
+	client := http.Client{Timeout: 2 * time.Second}
+	res, err := client.Get(url)
+	if err != nil {
+		os.Exit(1)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < http.StatusOK || res.StatusCode >= http.StatusMultipleChoices {
+		os.Exit(1)
+	}
+}

cmd/main.go

@@ -97,6 +97,10 @@ func main() {
 		},
 	)
 
+	app.Get("/healthz", func(c *fiber.Ctx) error {
+		return c.SendStatus(fiber.StatusOK)
+	})
+
 	userpass := os.Getenv("USERPASS")
 	if userpass != "" {
 		userpass := strings.Split(userpass, ":")

docker-compose.yaml

@@ -1,4 +1,3 @@
-version: '3'
 services:
   ladder:
     image: ghcr.io/everywall/ladder:latest
@@ -21,6 +20,14 @@ services:
       - LOG_URLS=true
       #- GODEBUG=netdns=go
       - FLARESOLVERR_HOST=http://flaresolverr:8191
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - apparmor:runtime/default
+      #- label:type:container_t  # SELinux alternative
+    tmpfs:
+      - /tmp
     ports:
       - "8080:8080"
     volumes: