diid

Appearance

Security Considerations ​

diid-push is designed to run inside private networks where it pushes API specifications outbound to the diid platform. This document describes the security posture of the Docker image and deployment recommendations.

Docker Image Hardening ​

The official diid-push Docker image implements the following security measures:

Distroless Base Image ​

The runtime image uses gcr.io/distroless/static-debian12:nonroot. This image contains:

  • No shell (/bin/sh, /bin/bash, etc.)
  • No package manager (apt, apk, etc.)
  • No libc (uses a statically linked Go binary)
  • No extraneous utilities (curl, wget, cat, etc.)

This dramatically reduces the attack surface. Even if an attacker achieves code execution, there are no tools available to escalate privileges or exfiltrate data.

Non-Root Execution ​

The container runs as the built-in nonroot user (UID 65532, GID 65532). The binary and all mounted directories are owned by this user. Root access is never required.

Statically Linked Binary ​

The Go binary is compiled with CGO_ENABLED=0, producing a fully static binary with no shared library dependencies. Combined with -trimpath, build paths are stripped from the binary to prevent information leakage.

Minimal Build Context ​

A .dockerignore file prevents sensitive files (.git, test data, CI configs) from being included in the Docker build context.

Deployment Recommendations ​

Read-Only Root Filesystem ​

Always run the container with a read-only root filesystem:

sh
# Docker CLI
docker run --read-only ...

# Docker Compose
read_only: true

# Kubernetes
securityContext:
  readOnlyRootFilesystem: true

Drop All Capabilities ​

The binary requires no Linux capabilities. Drop them all:

sh
# Docker CLI
docker run --cap-drop=ALL ...

# Docker Compose
cap_drop:
  - ALL

# Kubernetes
securityContext:
  capabilities:
    drop: ["ALL"]

Prevent Privilege Escalation ​

sh
# Docker CLI
docker run --security-opt=no-new-privileges:true ...

# Docker Compose
security_opt:
  - no-new-privileges:true

# Kubernetes
securityContext:
  allowPrivilegeEscalation: false

Mount Configs Read-Only ​

Always mount configuration files as read-only:

sh
docker run -v ./diid.yaml:/config/diid.yaml:ro ...

Use Secrets for Tokens ​

Never embed push tokens or other secrets directly in configuration files. Use environment variables or orchestrator-provided secret mechanisms (Kubernetes Secrets, Docker Secrets, etc.).

See Deployment Recipes for complete, security-hardened examples.

Supply Chain ​

  • Docker images are built via GoReleaser in GitHub Actions and published to GitHub Container Registry (GHCR)
  • Multi-architecture images (amd64, arm64) are published as OCI manifest lists
  • Release checksums are published alongside binary archives