mirror of
https://github.com/farcasclaudiu/Flowise.git
synced 2026-06-22 07:01:07 +03:00
Taraka Vishnumolakala
2414057c08
* feat(security): enhance file path validation and implement non-root Docker user - Validate resolved full file paths including workspace boundaries in SecureFileStore - Resolve paths before validation in readFile and writeFile operations - Run Docker container as non-root flowise user (uid/gid 1001) - Apply proper file ownership and permissions for application files Prevents path traversal attacks and follows container security best practices * Add sensitive system directory validation and Flowise internal file protection * Update Dockerfile to use default node user * update validation patterns to include additional system binary directories (/usr/bin, /usr/sbin, /usr/local/bin) * added isSafeBrowserExecutable function to validate browser executable paths for Playwright and Puppeteer loaders --------- Co-authored-by: taraka-vishnumolakala <taraka.vishnumolakala@workday.com> Co-authored-by: Henry Heng <henryheng@flowiseai.com> Co-authored-by: Henry <hzj94@hotmail.com>
42 lines
802 B
Docker
42 lines
802 B
Docker
# Build local monorepo image
|
|
# docker build --no-cache -t flowise .
|
|
|
|
# Run image
|
|
# docker run -d -p 3000:3000 flowise
|
|
|
|
FROM node:20-alpine
|
|
|
|
# Install system dependencies and build tools
|
|
RUN apk update && \
|
|
apk add --no-cache \
|
|
libc6-compat \
|
|
python3 \
|
|
make \
|
|
g++ \
|
|
build-base \
|
|
cairo-dev \
|
|
pango-dev \
|
|
chromium \
|
|
curl && \
|
|
npm install -g pnpm
|
|
|
|
ENV PUPPETEER_SKIP_DOWNLOAD=true
|
|
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
|
|
|
|
ENV NODE_OPTIONS=--max-old-space-size=8192
|
|
|
|
WORKDIR /usr/src/flowise
|
|
|
|
# Copy app source
|
|
COPY . .
|
|
|
|
# Install dependencies and build
|
|
RUN pnpm install && \
|
|
pnpm build
|
|
|
|
# Switch to non-root user (node user already exists in node:20-alpine)
|
|
USER node
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD [ "pnpm", "start" ] |