[Security] Data/config files are insecure in Docker image. Read permission for 'others' by default #1389

New Issue

OVERLORD · 2025-10-09T17:13:41+03:00

OVERLORD commented

2025-10-09 17:13:41 +03:00

Originally created by @jsalgado78 on GitHub.

Subject of the issue

Vaultwarden data/config files are insecure. Read permission for 'others' by default

Deployment environment

Docker

Steps to reproduce

docker run -it --rm vaultwarden/server:latest
 
Save configuration from Vaultwarden admin web UI

docker exec -it ls -las /data

Expected behaviour

Data/config files should have permission 0600. Read-write to owner
config.json should be encrypted if it's possible

Actual behaviour

Files like config.json and database are created with permission 0644 by default
config.json contains admin token in plaintext

4 drwxr-xr-x. 3 root root 4096 May 3 11:05 .
8 drwxr-xr-x. 1 root root 4096 May 3 10:04 ..
4 -rw-r--r--. 1 root root 1160 May 3 10:04 config.json
164 -rw-r--r--. 1 root root 167936 May 3 10:04 db.sqlite3
32 -rw-r--r--. 1 root root 32768 May 3 11:05 db.sqlite3-shm
0 -rw-r--r--. 1 root root 0 May 3 11:05 db.sqlite3-wal
4 drwxr-xr-x. 2 root root 4096 May 3 10:04 icon_cache
4 -rw-------. 1 root root 1193 May 3 10:04 rsa_key.der
4 -rw-------. 1 root root 1679 May 3 10:04 rsa_key.pem
4 -rw-r--r--. 1 root root 270 May 3 10:04 rsa_key.pub.der

Originally created by @jsalgado78 on GitHub. ### Subject of the issue Vaultwarden data/config files are insecure. Read permission for 'others' by default ### Deployment environment Docker ### Steps to reproduce ``` docker run -it --rm vaultwarden/server:latest Save configuration from Vaultwarden admin web UI docker exec -it ls -las /data ``` ### Expected behaviour Data/config files should have permission 0600. Read-write to owner config.json should be encrypted if it's possible ### Actual behaviour Files like config.json and database are created with permission 0644 by default config.json contains admin token in plaintext 4 drwxr-xr-x. 3 root root 4096 May 3 11:05 . 8 drwxr-xr-x. 1 root root 4096 May 3 10:04 .. 4 -rw-r--r--. 1 root root 1160 May 3 10:04 config.json 164 -rw-r--r--. 1 root root 167936 May 3 10:04 db.sqlite3 32 -rw-r--r--. 1 root root 32768 May 3 11:05 db.sqlite3-shm 0 -rw-r--r--. 1 root root 0 May 3 11:05 db.sqlite3-wal 4 drwxr-xr-x. 2 root root 4096 May 3 10:04 icon_cache 4 -rw-------. 1 root root 1193 May 3 10:04 rsa_key.der 4 -rw-------. 1 root root 1679 May 3 10:04 rsa_key.pem 4 -rw-r--r--. 1 root root 270 May 3 10:04 rsa_key.pub.der

OVERLORD closed this issue

2025-10-09 17:13:41 +03:00

OVERLORD commented

2025-10-09 17:13:43 +03:00

@BlackDex commented on GitHub:

I'm going to move this to the discussions under Ideas, also to keep the issues for actual issues to the software.

There are also some ways to have the user-id configurable via ENV's like some other docker images of some tools provide.
Not sure if that would be a good thing for this project, but i think we are open for any good written and documented PR regarding this.

@BlackDex commented on GitHub: I'm going to move this to the discussions under `Ideas`, also to keep the issues for actual issues to the software. There are also some ways to have the user-id configurable via ENV's like some other docker images of some tools provide. Not sure if that would be a good thing for this project, but i think we are open for any good written and documented PR regarding this.

OVERLORD referenced this issue

2025-10-09 18:23:24 +03:00

[PR #1389] [MERGED] Update Alpine base images to 3.13 #3435

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1389