From ee74c3c446c7da685afb035fbf913412c961acff Mon Sep 17 00:00:00 2001 From: Jorropo Date: Fri, 24 Jul 2026 10:28:21 +0200 Subject: [PATCH] lint: suppress intentional root USER in runtime Dockerfiles (#11166) meshtasticd must run as root to reach GPIO/I2C/SPI hardware, so the final USER root is deliberate. The existing file-level ignore used the old trivy code (DS002); rename it to DS-0002 and add checkov/CKV_DOCKER_8 so the last-USER-root findings are suppressed with an explicit justification. --- Dockerfile | 3 ++- alpine.Dockerfile | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index c7b48313e..a8d886569 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,5 @@ -# trunk-ignore-all(trivy/DS002): We must run as root for this container +# trunk-ignore-all(trivy/DS-0002): We must run as root for this container +# trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container # trunk-ignore-all(hadolint/DL3002): We must run as root for this container # trunk-ignore-all(hadolint/DL3008): Do not pin apt package versions # trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions diff --git a/alpine.Dockerfile b/alpine.Dockerfile index facc180b8..e82230d61 100644 --- a/alpine.Dockerfile +++ b/alpine.Dockerfile @@ -1,4 +1,5 @@ -# trunk-ignore-all(trivy/DS002): We must run as root for this container +# trunk-ignore-all(trivy/DS-0002): We must run as root for this container +# trunk-ignore-all(checkov/CKV_DOCKER_8): We must run as root for this container # trunk-ignore-all(hadolint/DL3002): We must run as root for this container # trunk-ignore-all(hadolint/DL3018): Do not pin apk package versions # trunk-ignore-all(hadolint/DL3013): Do not pin pip package versions