From 0d8d8c43bef78ac6ac5540ce86e6ac7efb750182 Mon Sep 17 00:00:00 2001
From: Fi3w0 <alex.lazarevych@icloud.com>
Date: Mon, 24 Aug 2026 23:36:18 +0200
Subject: [PATCH] fix(security): harden release images

---
 apps/api/go.mod          | 4 ++--
 apps/api/go.sum          | 8 ++++----
 build/api.Dockerfile     | 1 +
 build/loadgen.Dockerfile | 1 +
 build/web.Dockerfile     | 1 +
 5 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/apps/api/go.mod b/apps/api/go.mod
index 585715d..3731404 100644
--- a/apps/api/go.mod
+++ b/apps/api/go.mod
@@ -34,9 +34,9 @@ require (
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.39.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
diff --git a/apps/api/go.sum b/apps/api/go.sum
index 6fff21f..b0f718c 100644
--- a/apps/api/go.sum
+++ b/apps/api/go.sum
@@ -83,12 +83,12 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
 golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
diff --git a/build/api.Dockerfile b/build/api.Dockerfile
index 0dfa167..fbbde45 100644
--- a/build/api.Dockerfile
+++ b/build/api.Dockerfile
@@ -14,5 +14,6 @@ RUN CGO_ENABLED=0 go build \
 FROM gcr.io/distroless/static:nonroot
 
 COPY --from=build /out/nereus-api /nereus-api
+USER nonroot:nonroot
 EXPOSE 8080
 ENTRYPOINT ["/nereus-api"]
diff --git a/build/loadgen.Dockerfile b/build/loadgen.Dockerfile
index 5e98bb3..8b0057f 100644
--- a/build/loadgen.Dockerfile
+++ b/build/loadgen.Dockerfile
@@ -13,4 +13,5 @@ RUN CGO_ENABLED=0 go build \
 FROM gcr.io/distroless/static:nonroot
 
 COPY --from=build /out/nereus-loadgen /nereus-loadgen
+USER nonroot:nonroot
 ENTRYPOINT ["/nereus-loadgen"]
diff --git a/build/web.Dockerfile b/build/web.Dockerfile
index 31c0a80..9a90876 100644
--- a/build/web.Dockerfile
+++ b/build/web.Dockerfile
@@ -6,4 +6,5 @@ COPY ${WEB_ASSET_PATH}/index.html ${WEB_ASSET_PATH}/styles.css ${WEB_ASSET_PATH}
 COPY ${WEB_ASSET_PATH}/assets/ /usr/share/nginx/html/assets/
 COPY ${WEB_ASSET_PATH}/vendor/ /usr/share/nginx/html/vendor/
 
+USER 101
 EXPOSE 8080