From cb9a4be74455dd76b4514498b70f26fd6a9dc6ea Mon Sep 17 00:00:00 2001 From: Tomi Turtiainen <10324676+tomi@users.noreply.github.com> Date: Mon, 13 Oct 2025 09:56:46 +0300 Subject: [PATCH] build: Make runner's code files readonly (#20702) --- docker/images/runners/Dockerfile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docker/images/runners/Dockerfile b/docker/images/runners/Dockerfile index 87fcca76e0c..ff06f800ea5 100644 --- a/docker/images/runners/Dockerfile +++ b/docker/images/runners/Dockerfile @@ -118,13 +118,12 @@ COPY --from=node-alpine /usr/local/bin/node /usr/local/bin/node RUN apk add --no-cache ca-certificates tini libstdc++ libc6-compat RUN addgroup -g 1000 -S runner \ - && adduser -u 1000 -S -G runner -h /home/runner -D runner \ - && install -d -o runner -g runner /opt/runners + && adduser -u 1000 -S -G runner -h /home/runner -D runner WORKDIR /home/runner -COPY --from=javascript-runner-builder --chown=runner:runner /app/task-runner-javascript /opt/runners/task-runner-javascript -COPY --from=python-runner-builder --chown=runner:runner /app/task-runner-python /opt/runners/task-runner-python +COPY --from=javascript-runner-builder --chown=root:root /app/task-runner-javascript /opt/runners/task-runner-javascript +COPY --from=python-runner-builder --chown=root:root /app/task-runner-python /opt/runners/task-runner-python COPY --from=launcher-downloader /launcher-bin/* /usr/local/bin/ COPY --chown=root:root docker/images/runners/n8n-task-runners.json /etc/n8n-task-runners.json