[Deployment] Development files are copied into the production image
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker
- Domain
- devops
Research direction
Start by reading the Dockerfile and existing .dockerignore to see what the build copies into /app and what the runtime needs. Add development and test files such as requirements-dev.txt, tests, .github/, and docs/ to the ignore list, adjusting it for runtime needs. Done when those files are absent from the published image while required application files remain available.
Written by the indexing model from the issue text.
Description
Labels: docker, security
Summary
COPY . . puts requirements-dev.txt, and any other development or test files, into /app in the published image. Vulnerability scanners read requirement files, so the image is reported as vulnerable to packages it doesn't actually install. For example, Amazon Inspector reports black 25.1.0 → 26.3.0 (CVE-2026-31900, CRITICAL) from requirements-dev.txt, even though pip list doesn't show black.
Suggested fix
Add the development files to .dockerignore:
requirements-dev.txt
**/tests/
.github/
docs/
Adjust the list to whatever the runtime doesn't need.
- Dominant language
- HTML
- Stars
- 6
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from brainthee/CHAOTICA
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
[Minor UI Bug] Client page shows account manager photos as squares overlapping the round borderOpen
Difficulty 1/5 Under an hour Newbie friendliness 94/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
All issues in brainthee/CHAOTICA
Similar issues
-
area-infrastructure
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dotnet/aspnetcore#70524 · 1 comment ·
Maintainers usually reply within 1 day
-
area:evals area:infra enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
jse-avl/support-bot#4 · 1 comment ·
-
area/installation kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
vllm-project/aibrix#3456 · 1 comment ·
Maintainers usually reply within 1 day
-
Same-repo PRs never get the required appveyor/pr checkPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 74/100
activescott/lessmsi#309 · 3 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
gotestyourself/gotestsum#579 ·