trivy_image_scan

- pump numpy to v2.3.5
- run container with

.gitea/workflows/trivy_image_scan.yml

@@ -0,0 +1,28 @@
+name: release-tag
+
+on:
+  workflow_dispatch: # Manuelles Auslösen des Workflows
+    inputs:
+      image_tag:
+        description: 'Tag für das zu scannende Docker-Image z.B. latest'
+        required: true
+        default: 'latest'
+
+env:
+  image_name: mysteryhelfer
+  registry_gitea: gitea.tebarius.duckdns.org
+  user: tebarius
+
+jobs:
+  trivy_image_scan:
+    runs-on: ubuntu-latest
+    container: aquasec/trivy:latest
+    steps:
+      - name: Scan image with trivy
+        run: |
+          trivy image \
+          --exit-code 1 \
+          --scanners vuln,misconfig,secret \
+          --severity MEDIUM,HIGH,CRITICAL \
+          --ignore-unfixed \
+          ${{ env.registry_gitea }}/${{ env.user }}/${{ env.image_name }}:${{ github.event.inputs.image_tag }}

Dockerfile

@@ -5,27 +5,30 @@ LABEL description="tebarius Mysteryhelfer web"
 
 WORKDIR /app
 
-RUN apt-get update  \
+RUN apt-get update \
-    && apt-get install -y curl \
+    && apt-get install -y --no-install-recommends curl \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-RUN python -m pip install --upgrade pip
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-
 COPY ./app /app
 
+RUN python -m pip install --upgrade pip \
+    && pip install --no-cache-dir -r requirements.txt
+
+
 # ein bisschen Patchen um auch beim Bookmarken oder Versenden der Webadresse per Messenger den richtigen Titel und das
 # richtige Favicon zu verwenden/sehen
 COPY ./app/images/favicon.ico /usr/local/lib/python3.13/site-packages/streamlit/static/favicon.ico
 RUN sed -i -e 's|favicon\.png|favicon.ico|' \
            -e 's|<title>.*</title>|<title>tebarius Mysteryhelfer (web)</title>|' \
-           /usr/local/lib/python3.13/site-packages/streamlit/static/index.html
+           /usr/local/lib/python3.13/site-packages/streamlit/static/index.html \
-
+    && useradd -m -u 1000 myst \
+    && chown -R myst:myst /app
+USER myst
 
 EXPOSE 8501
 
 HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health
 
-ENTRYPOINT ["streamlit", "run", "app.py", "--server.port=8501", "--server.address=0.0.0.0"]
+ENTRYPOINT ["streamlit", "run", "app.py", "--server.port=8501", "--server.address=0.0.0.0"]

examples.py

@@ -1,84 +0,0 @@
-# Copyright (c) 2025 Martin Kayser (tebarius)
-# Licensed under the MIT License. See LICENSE file in the project root.
-# start with: streamlit run examples.py
-import streamlit as st
-
-
-st.write("# Hello World !")
-
-
-import pandas as pd
-df = pd.DataFrame({
-  'first column': [1, 2, 3, 4],
-  'second column': [10, 20, 30, 40]
-})
-df
-
-
-st.table(df)
-
-
-import pandas as pd
-st.map(pd.DataFrame({'lat':[52.3642], 'lon':[13.0906]}), zoom=17, size=5)
-
-
-import streamlit as st
-x = st.slider('x', 32, 233)  # 👈 this is a widget
-st.write(x, 'squared is', x * x)
-
-
-st.text_input("Your name", key="name")
-# You can access the value at any point with:
-st.session_state.name
-
-
-import numpy as np
-import pandas as pd
-
-if st.checkbox('Show dataframe'):
-    chart_data = pd.DataFrame(
-       np.random.randn(20, 3),
-       columns=['a', 'b', 'c'])
-    chart_data
-
-
-import pandas as pd
-df = pd.DataFrame({
-    'first column': [1, 2, 3, 4],
-    'second column': [10, 20, 30, 40]
-    })
-option = st.selectbox(
-    'Which number do you like best?',
-     df['first column'])
-'You selected: ', option
-
-
-add_selectbox = st.sidebar.selectbox(
-    'How would you like to be contacted?',
-    ('Email', 'Home phone', 'Mobile phone')
-)
-# Add a slider to the sidebar:
-add_slider = st.sidebar.slider(
-    'Select a range of values',
-    0.0, 100.0, (25.0, 75.0)
-)
-
-add_selectbox
-add_slider
-
-
-left_column, right_column = st.columns(2)
-# You can use a column just like st.sidebar:
-left_column.button('Press me!')
-# Or even better, call Streamlit functions inside a "with" block:
-with right_column:
-    chosen = st.radio(
-        'Sorting hat',
-        ("Gryffindor", "Ravenclaw", "Hufflepuff", "Slytherin"))
-    st.write(f"You are in {chosen} house!")
-
-
-st.progress(80)
-
-st.text_area("Your text", key="te")
-st.session_state.te

readme.md

@@ -13,19 +13,19 @@ Der einfachst Weg, um die App lokal laufen zu lassen, ist mit Docker, wobei ich
      ```
      services:
        mysteryhelfer-web:
-       image: gitea.tebarius.duckdns.org/tebarius/mysteryhelfer
+         image: gitea.tebarius.duckdns.org/tebarius/mysteryhelfer
-       ports:
+         ports:
-         - "8501:8501"
+           - "8501:8501"
-       restart: unless-stopped
+         restart: unless-stopped
      ```
      alternativ (via Docker Hub):  
      ```
      services:
        mysteryhelfer-web:
-       image: tebarius/mysteryhelfer
+         image: tebarius/mysteryhelfer
-       ports:
+         ports:
-         - "8501:8501"
+           - "8501:8501"
-       restart: unless-stopped
+         restart: unless-stopped
      ```
    - `docker compose up -d`