fix: patch vulnerabilities

[yabets4]

$(cat VULNS.md)

[yabets4]

[MEDIUM] CWE-250 — Docker Containers Running as Root

CVSS: 5.3 | KEV: N/A (Design weakness, not a CVE)

Finding 1: install/sidecar-disk-collector/Dockerfile
Status: FIXED — Added non-root user nomaduser with USER directive

Finding 2: install/sidecar-updater/Dockerfile
Status: FIXED — Added non-root user nomaduser with USER directive

Details:

• Both Docker containers were running as root by default (no USER directive)
• If an attacker compromises the container, they gain root privileges on the host (container escape risk)
• Applied fix: Created nomaduser (UID 1000) and added USER nomaduser directive before CMD

Kill Chain:

• Container compromise → Root access in container → Potential container escape → Host compromise
• Confidence: MEDIUM