Possible by not specifying a USER, a program in the container may run as 'root' in graphviz.Dockerfile

[begininvoke]

Came across something in docker/graphviz.Dockerfile around line 10 that looked worth flagging.

The Dockerfile lacks a USER instruction, causing the container to run as root by default. This violates the principle of least privilege: if an attacker compromises the graphviz.sh entrypoint, they gain full root access inside the container, increasing the risk of container escape and lateral movement. Severity is high because root privileges amplify the impact of any vulnerability in the application.

The code in question

ENTRYPOINT ["/dot/graphviz.sh"]

Something like this might fix it:

--- a/docker/graphviz.Dockerfile
+++ b/docker/graphviz.Dockerfile
@@ -7,6 +7,10 @@
 # ... previous lines ...
 
+RUN groupadd -r appgroup && useradd -r -g appgroup appuser
+USER appuser
+
 ENTRYPOINT ["/dot/graphviz.sh"]

For reference: rule dockerfile.security.missing-user-entrypoint.missing-user-entrypoint, CWE-269 (Improper Privilege Management). Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.