Oleksandr Bezdieniezhnykh
2.5 KiB
Infrastructure Security Review
Date: 2026-05-07 Scope: Dockerfiles, compose files, environment templates, GitHub Actions Result: PASS_WITH_WARNINGS
Reviewed Artifacts
deployment/docker/Dockerfile.runtimedeployment/docker/Dockerfile.replaydocker-compose.ymldocker-compose.test.yml.github/workflows/ci.yml.env.exampleconfig/development/runtime.envconfig/ci/runtime.envconfig/jetson/runtime.env
Findings
| ID | Severity | Category | Location | Title |
|---|---|---|---|---|
| I1 | Medium | Security Misconfiguration | docker-compose.yml:7, docker-compose.yml:9, .env.example:5 |
Default Postgres password and exposed host port need stronger dev/prod separation |
| I2 | Low | CI/CD Hardening | .github/workflows/ci.yml |
CI lacks dependency audit / secret scan / SAST gates |
Finding Details
I1: Default Postgres password and exposed host port need stronger dev/prod separation
docker-compose.yml uses POSTGRES_PASSWORD=gpsd, publishes 5432:5432, and points runtime at .env.example, which embeds the same example credentials in GPSD_DATABASE_URL.
Impact: Safe enough for local development if never deployed, but risky if copied into staging, Jetson, or field environments.
Remediation: Move credentials into an ignored local .env, document docker-compose.yml as development-only, bind local Postgres to loopback, and require production/Jetson credentials from a secret manager or deployment-time secret source.
I2: CI lacks dependency audit / secret scan / SAST gates
.github/workflows/ci.yml runs format, lint, unit tests, and compose config validation, but it does not run dependency audit, secret scanning, or SAST.
Impact: Vulnerable dependencies or accidentally committed secrets may be caught only during manual audits.
Remediation: Add pip-audit for Python dependencies, a secret scanner such as Gitleaks/TruffleHog, and a lightweight SAST pass such as Semgrep or Ruff security rules when the project adopts them.
Positive Controls
- Runtime and replay Dockerfiles create and run as a non-root
gpsduser. - Runtime image copies only project source and
pyproject.toml/README.md, not.envor fixture payloads. docker-compose.test.ymlkeeps replay/SITL/cache stubs on isolated compose networks and exposes no host ports.config/jetson/runtime.envcontains paths and mode labels only; it does not include embedded passwords or signing keys.