nmeyer99/webdav repository overview

⁠Webdav (nginx) Container

Plattform	Link
	Webdav⁠
	Webdav⁠

⁠Why Run Nginx as a Non-Root User?

For security reasons, Nginx should not run as root inside a container. By default, many container processes run as root, which poses a high risk. If a vulnerability is exploited, an attacker could gain full control over the host server.

By starting the Nginx process as a non-root user, you significantly limit the potential damage in case of an attack. The attacker would only have the restricted privileges of that user and couldn't access or manipulate the underlying host system.

⁠Container Security

While containers offer good isolation, they are not immune to attacks. Key security practices include:

• Regularly updating the container image.
• Using a minimalist image with only essential components.
• Running containers as a non-root user.
• Setting restrictive access permissions within the container image.

⁠UID/GID Matching (optional)

To avoid permission issues with bind mounts, you can build the image so that the nginx user inside the container uses the same UID/GID as your host user.

• Build with host IDs:
  • docker build --build-arg NGINX_UID=$(id -u) --build-arg NGINX_GID=$(id -g) -t nmeyer99/webdav:latest .
• Defaults (if not provided): NGINX_UID=100, NGINX_GID=101.

Note: The container still runs as nginx (not root). The Apache config also uses User nginx/Group ngin.

⁠Optional apk upgrade during build

You can opt-in to upgrading all base packages during build via a build arg:

• Enable upgrade: docker build --build-arg APK_UPGRADE=true -t nmeyer99/webdav:latest .
• Default: APK_UPGRADE=false (no upgrade for reproducibility)

The Dockerfile conditionally runs apk update && apk upgrade before installing required packages.

⁠Image version label

You can set the image metadata version label via a build arg:

• From git tag/commit: docker build --build-arg IMAGE_VERSION=$(git describe --tags --always --dirty) -t nmeyer99/webdav:latest .
• Or short commit: docker build --build-arg IMAGE_VERSION=$(git rev-parse --short HEAD) -t nmeyer99/webdav:latest .

This value is written to label org.opencontainers.image.version.

⁠Runtime version file

The image also writes the version into a file inside the container for easy runtime inspection:

• Path: /etc/image-version
• Check inside container: cat /etc/image-version

⁠Docker-compose

services:
  webdav:
    container_name: webdav
    image: webdav:dev
    networks:
      - internal
    ports:
      - "8011:80"
    volumes:
      - ./data:/app/inbox
    restart: unless-stopped