From 6f4a1129bb7e061d57f7dda99a817823186b15f8 Mon Sep 17 00:00:00 2001 From: Meo597 <197331664+Meo597@users.noreply.github.com> Date: Tue, 20 Oct 2026 21:36:42 +0800 Subject: [PATCH] restrict config access --- .github/docker/Dockerfile | 4 ++-- .github/docker/Dockerfile.usa | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/docker/Dockerfile b/.github/docker/Dockerfile index cb757486a..1b1f61fb9 100644 --- a/.github/docker/Dockerfile +++ b/.github/docker/Dockerfile @@ -46,8 +46,8 @@ FROM gcr.io/distroless/static:nonroot COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/ -COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray -COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/ +COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray +COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/ COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray VOLUME /usr/local/etc/xray diff --git a/.github/docker/Dockerfile.usa b/.github/docker/Dockerfile.usa index 328d117ff..cfdcf7103 100644 --- a/.github/docker/Dockerfile.usa +++ b/.github/docker/Dockerfile.usa @@ -55,8 +55,8 @@ FROM --platform=linux/amd64 gcr.io/distroless/static:nonroot COPY --from=build --chown=0:0 --chmod=755 /src/xray /usr/local/bin/xray COPY --from=build --chown=65532:65532 --chmod=755 /tmp/empty /usr/local/share/xray COPY --from=build --chown=65532:65532 --chmod=644 /tmp/geodat/*.dat /usr/local/share/xray/ -COPY --from=build --chown=0:0 --chmod=755 /tmp/empty /usr/local/etc/xray -COPY --from=build --chown=0:0 --chmod=644 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/ +COPY --from=build --chown=0:65532 --chmod=750 /tmp/empty /usr/local/etc/xray +COPY --from=build --chown=0:65532 --chmod=640 /tmp/usr/local/etc/xray/*.json /usr/local/etc/xray/ COPY --from=build --chown=65532:65532 --chmod=700 /tmp/empty /var/log/xray VOLUME /usr/local/etc/xray