From 12ff2311e58c3769b1d8593841ce7438f556edce Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:20:09 +0100
Subject: [PATCH 1/6] #501 Reach the bundle file input by name in the
 import-problems E2E test

PR #632 made every file input the GOV.UK enhanced File upload, whose
script moves the input's id onto its button, so Page.Locator("#bundle")
resolved to a <button> and SetInputFilesAsync failed with "Node is not an
HTMLInputElement". Every whole-suite run on main since 16 Oct has
reported this one failure. Target the native input by name, as the rest
of the suite does.

Refs #501, #380

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Admin/ContentStagingImportProblemsTests.cs                | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/DfE.CheckPerformanceData.E2ETests/Admin/ContentStagingImportProblemsTests.cs b/tests/DfE.CheckPerformanceData.E2ETests/Admin/ContentStagingImportProblemsTests.cs
index c431835b..557d130a 100644
--- a/tests/DfE.CheckPerformanceData.E2ETests/Admin/ContentStagingImportProblemsTests.cs
+++ b/tests/DfE.CheckPerformanceData.E2ETests/Admin/ContentStagingImportProblemsTests.cs
@@ -37,7 +37,9 @@ public async Task A_broken_page_is_left_out_and_a_segment_with_capitals_is_lower
         var json = JsonSerializer.Serialize(bundle).Replace("\"schema\":", "\"$schema\":");
 
         await Page.GotoAsync($"{Fixture.BaseUrl}/admin/content-staging");
-        await Page.Locator("#bundle").SetInputFilesAsync(new FilePayload
+        // The enhanced GOV.UK file upload (#632) moves the id onto its button, so reach the native
+        // input by name, as every other SetInputFilesAsync in the suite does.
+        await Page.Locator("input[name='bundle']").SetInputFilesAsync(new FilePayload
         {
             Name = "bundle.json", MimeType = "application/json", Buffer = Encoding.UTF8.GetBytes(json)
         });

From 78dbb1e007a7bccfdfa13ea87f46e40a86d679c8 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:22:21 +0100
Subject: [PATCH 2/6] #609 Pin the container user and non-root enforcement in a
 source test

Red on purpose: the Web Dockerfile has no USER line and neither AKS
module sets run_as_non_root. The next commits turn it green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Web/ContainerUserSourceTests.cs           | 87 +++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs

diff --git a/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs b/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs
new file mode 100644
index 00000000..3d0aca2e
--- /dev/null
+++ b/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs
@@ -0,0 +1,87 @@
+using System.Runtime.CompilerServices;
+using System.Text.RegularExpressions;
+
+namespace DfE.CheckPerformanceData.Application.UnitTests.Web;
+
+// Both runtime images must run as the aspnet image's unprivileged `app` user, and the AKS modules
+// must enforce it (#609, OWASP least privilege). The user is written as `USER $APP_UID` — uid 1654,
+// numeric — because Kubernetes' runAsNonRoot check reads the image's USER and refuses a name.
+// Nothing else in the build notices a dropped line: the image still builds and the pod still
+// starts, and the only difference is that `id` inside it says root.
+public sealed class ContainerUserSourceTests
+{
+    [Theory]
+    [InlineData("DfE.CheckPerformanceData.Web")]
+    [InlineData("DfE.CheckPerformanceData.RulesEngineWorker")]
+    public void BaseStage_RunsAsTheAppUser(string project)
+    {
+        var dockerfile = File.ReadAllText(Path.Combine(RepoRoot, "src", project, "Dockerfile"));
+
+        Assert.Contains("USER $APP_UID", StageNamed(dockerfile, "base"));
+    }
+
+    [Fact]
+    public void WebDebugStage_HandsBackToTheAppUser_AfterInstallingTheDebugger()
+    {
+        var dockerfile = File.ReadAllText(Path.Combine(RepoRoot, "src", "DfE.CheckPerformanceData.Web", "Dockerfile"));
+        var stage = StageNamed(dockerfile, "debug-runtime");
+
+        var root = stage.IndexOf("USER root", StringComparison.Ordinal);
+        var install = stage.IndexOf("apt-get install", StringComparison.Ordinal);
+        var app = stage.LastIndexOf("USER $APP_UID", StringComparison.Ordinal);
+
+        Assert.True(install >= 0, "the debug stage installs the debugger with apt-get");
+        Assert.True(root >= 0 && root < install, "the apt-get install needs root, so USER root must come before it");
+        Assert.True(app > install, "the stage must hand back to the app user after the install");
+    }
+
+    [Theory]
+    [InlineData("web_application")]
+    [InlineData("rules_engine_worker")]
+    public void AksModule_EnforcesNonRoot(string module)
+    {
+        var tf = File.ReadAllText(Path.Combine(RepoRoot, "terraform", "application", "application.tf"));
+
+        Assert.Matches(new Regex(@"run_as_non_root\s*=\s*true"), ModuleBlock(tf, module));
+    }
+
+    // The text of one build stage: from its `FROM … AS <name>` line to the next `FROM` or the end.
+    private static string StageNamed(string dockerfile, string name)
+    {
+        var match = Regex.Match(
+            dockerfile,
+            $@"^FROM .* AS {Regex.Escape(name)}[ \t]*\r?$(.*?)(?=^FROM |\z)",
+            RegexOptions.Multiline | RegexOptions.Singleline);
+
+        Assert.True(match.Success, $"no stage named {name}");
+        return match.Groups[1].Value;
+    }
+
+    // The text of one `module "<name>" { … }` block, up to its closing brace at column 0.
+    private static string ModuleBlock(string tf, string name)
+    {
+        var start = tf.IndexOf($"module \"{name}\" {{", StringComparison.Ordinal);
+        Assert.True(start >= 0, $"no module {name}");
+
+        var end = tf.IndexOf("\n}", start, StringComparison.Ordinal);
+        Assert.True(end > start, $"module {name} never closes");
+        return tf[start..end];
+    }
+
+    private static string RepoRoot
+    {
+        get
+        {
+            var dir = new DirectoryInfo(Path.GetDirectoryName(ThisFilePath())!);
+            while (dir is not null && !File.Exists(Path.Combine(dir.FullName, "Makefile")))
+            {
+                dir = dir.Parent;
+            }
+
+            return dir?.FullName
+                ?? throw new InvalidOperationException("Could not locate the repository root from the test file path.");
+        }
+    }
+
+    private static string ThisFilePath([CallerFilePath] string path = "") => path;
+}

From b297195b63eab9d516d6481417fb500e25dd0278 Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:26:33 +0100
Subject: [PATCH 3/6] #609 Run the web container as the aspnet image's app user

USER $APP_UID in the base stage, as the worker image already does, so
the runtime stage CI deploys runs as uid 1654 instead of root. The VS
Code debug stage takes root back for its apt-get install and hands it
over again after the copy. Nothing the app does at run time writes
outside what that user can write: data-protection keys go to blob
storage and upload buffering goes to /tmp.

Proven locally: id inside the built image is uid=1654(app), /healthcheck
answers 200 and the E2E smoke set passes against the container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/DfE.CheckPerformanceData.Web/Dockerfile | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/DfE.CheckPerformanceData.Web/Dockerfile b/src/DfE.CheckPerformanceData.Web/Dockerfile
index 37dffcea..87856a01 100644
--- a/src/DfE.CheckPerformanceData.Web/Dockerfile
+++ b/src/DfE.CheckPerformanceData.Web/Dockerfile
@@ -18,6 +18,12 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 EXPOSE 8080
+# Run as the image's unprivileged `app` user (least privilege, #609), as the worker image does.
+# $APP_UID is the numeric uid 1654 the aspnet image defines; it must stay numeric because
+# Kubernetes' runAsNonRoot check reads the image's USER and refuses a name. The app writes
+# nothing to disk at run time: data-protection keys persist to blob storage, and the multipart
+# buffering ASP.NET does for large uploads goes to /tmp, which is world-writable.
+USER $APP_UID
 
 # Build
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
@@ -57,6 +63,9 @@ RUN dotnet publish DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csp
 # Derives from `base` so it carries the same OS security updates.
 FROM base AS debug-runtime
 
+# `base` runs as the app user; installing the debugger needs root. Handed back below.
+USER root
+
 # Install vsdbg — the .NET debugger used by VS Code Docker/C# Dev Kit
 RUN apt-get update && apt-get install -y --no-install-recommends unzip wget && \
     rm -rf /var/lib/apt/lists/* && \
@@ -65,6 +74,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends unzip wget && \
 
 COPY --from=vscode-debug /app/publish .
 
+# Back to the unprivileged user so the debug image runs the way the deployed one does.
+USER $APP_UID
+
 # Disable debug wait so the app starts immediately; the debugger attaches on demand
 ENV COMPlus_DebugWait=0
 

From fc41e4bfb6413e36553fca8a2644f86976a5e95d Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:28:52 +0100
Subject: [PATCH 4/6] #609 Enforce run_as_non_root on the web and worker
 deployments

Both images now carry a numeric USER, so Kubernetes can refuse to start
either pod as root. The shared aks/application module exposes the flag
on every branch the environments pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 terraform/application/application.tf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/terraform/application/application.tf b/terraform/application/application.tf
index 144054e6..e1acc154 100644
--- a/terraform/application/application.tf
+++ b/terraform/application/application.tf
@@ -47,6 +47,10 @@ module "web_application" {
   enable_logit = var.enable_logit
   web_port     = 8080
 
+  # The image runs as the numeric app user (USER $APP_UID in its Dockerfile); have Kubernetes
+  # refuse to start it as anything else (#609, OWASP least privilege).
+  run_as_non_root = true
+
   send_traffic_to_maintenance_page = var.send_traffic_to_maintenance_page
 
   enable_gcp_wif = var.enable_dfe_analytics_federated_auth
@@ -82,6 +86,9 @@ module "rules_engine_worker" {
   docker_image = var.worker_docker_image
   enable_logit = var.enable_logit
 
+  # The worker image has run as the numeric app user all along; enforce it too (#609).
+  run_as_non_root = true
+
   # Gate startup and liveness on readiness so a worker that cannot reach its database
   # or queue is detected and restarted rather than left silently stuck. The liveness
   # path is the lighter process-up signal exposed for orchestrators that probe it.

From 7d3f2aa2ba276d32c3ae8e60693b42038555a86d Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:35:23 +0100
Subject: [PATCH 5/6] #609 Note the non-root containers in the technical
 overview

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/technical-stakeholders-functional-overview.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/technical-stakeholders-functional-overview.md b/docs/technical-stakeholders-functional-overview.md
index 56334e54..aa7d205b 100644
--- a/docs/technical-stakeholders-functional-overview.md
+++ b/docs/technical-stakeholders-functional-overview.md
@@ -311,7 +311,7 @@ Producer/consumer split so requests never wait on Notify: `RequestNotificationSe
 
 ## 16. Hosting & deployment
 
-- **Docker**: multi-stage Dockerfiles for Web and Worker (sdk:10.0 → aspnet:10.0, port 8080); pinned Playwright image for E2E; nginx maintenance page (`maintenance_page/`).
+- **Docker**: multi-stage Dockerfiles for Web and Worker (sdk:10.0 → aspnet:10.0, port 8080); both runtime images run as the aspnet image's unprivileged `app` user (uid 1654, `USER $APP_UID`) and the AKS modules enforce `run_as_non_root` (#609); pinned Playwright image for E2E; nginx maintenance page (`maintenance_page/`).
 - **docker-compose**: profiled services — `web`, `rules_engine`, `db` (Postgres 18.1-alpine), `azurite` (+ one-shot `azurite_init` rules seeder), `pgadmin`; `docker-compose.e2e.yml` adds the one-shot `e2e-tests` runner (kept separate so the VS `docker-compose.dcproj` orchestration ignores it). Never add a `docker-compose.override.yml` (breaks `make test-e2e`).
 - **CI/CD** (`.github/workflows/build-and-deploy.yml`): build + push both images to GHCR + Snyk scan → PR review apps (`deploy` label) → E2E (non-visual) against the review app → sequential deploy matrix **development → qa → preproduction → production** on push to `main`, via shared `DFE-Digital/github-actions` actions. Also: DB backup/PTR/restore workflows, maintenance toggle, Terraform validation, review-app teardown.
 - **Terraform** (`terraform/application/`): AKS web app + worker (separate replica counts, exec health probes), Azure Postgres **Flexible Server v17** (note: local compose runs 18.1), two storage accounts (app: `files`, `rules-config`; private LDS ingress account), two Key Vaults, StatusCake, GCP WIF for analytics; `terraform/domains/` for DNS + Front Door. Environments: development, qa, review (per-PR), preproduction, production (`config/*.tfvars.json`).

From c79b88ae343d1727f6ccacba1077c56b2afe402c Mon Sep 17 00:00:00 2001
From: Andy Smith <andy.smith@education.gov.uk>
Date: Mon, 19 Oct 2026 11:41:23 +0100
Subject: [PATCH 6/6] #609 Pin the user the shipped stages run as, not a
 substring of base

The test only looked for "USER $APP_UID" inside base, so a later USER root
in base, Web runtime or worker final, or a comment naming the directive,
still passed. It now takes the last real USER directive across base plus the
shipped stage, matches directives (not comments) in the debug-stage and
stage-header regexes, anchors the run_as_non_root check, and the class
comment no longer claims a root image starts fine on AKS (it is refused).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Web/ContainerUserSourceTests.cs           | 56 ++++++++++++++-----
 1 file changed, 42 insertions(+), 14 deletions(-)

diff --git a/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs b/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs
index 3d0aca2e..50d6663a 100644
--- a/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs
+++ b/tests/DfE.CheckPerformanceData.UnitTests/Web/ContainerUserSourceTests.cs
@@ -6,33 +6,52 @@ namespace DfE.CheckPerformanceData.Application.UnitTests.Web;
 // Both runtime images must run as the aspnet image's unprivileged `app` user, and the AKS modules
 // must enforce it (#609, OWASP least privilege). The user is written as `USER $APP_UID` — uid 1654,
 // numeric — because Kubernetes' runAsNonRoot check reads the image's USER and refuses a name.
-// Nothing else in the build notices a dropped line: the image still builds and the pod still
-// starts, and the only difference is that `id` inside it says root.
+// Locally nothing notices a dropped line: the image builds and compose runs it as root. On AKS the
+// pod is refused at deploy time, far from the cause.
 public sealed class ContainerUserSourceTests
 {
     [Theory]
     [InlineData("DfE.CheckPerformanceData.Web")]
     [InlineData("DfE.CheckPerformanceData.RulesEngineWorker")]
-    public void BaseStage_RunsAsTheAppUser(string project)
+    public void BaseStage_DeclaresTheAppUser(string project)
     {
-        var dockerfile = File.ReadAllText(Path.Combine(RepoRoot, "src", project, "Dockerfile"));
+        var dockerfile = File.ReadAllText(DockerfilePath(project));
 
-        Assert.Contains("USER $APP_UID", StageNamed(dockerfile, "base"));
+        Assert.Contains("$APP_UID", UserDirectives(StageNamed(dockerfile, "base")));
+    }
+
+    // The effective user is the last USER directive across the stages the shipped one builds on, so a
+    // later `USER root` in the shipped stage (or in base) must fail even though base still names the app user.
+    [Theory]
+    [InlineData("DfE.CheckPerformanceData.Web", "runtime")]
+    [InlineData("DfE.CheckPerformanceData.RulesEngineWorker", "final")]
+    public void ShippedStage_RunsAsTheAppUser(string project, string shippedStage)
+    {
+        var dockerfile = File.ReadAllText(DockerfilePath(project));
+        var shipped = StageNamed(dockerfile, shippedStage);
+
+        Assert.StartsWith("FROM base AS", shipped);
+
+        var users = UserDirectives(StageNamed(dockerfile, "base")).Concat(UserDirectives(shipped)).ToList();
+
+        Assert.NotEmpty(users);
+        Assert.Equal("$APP_UID", users[^1]);
     }
 
     [Fact]
     public void WebDebugStage_HandsBackToTheAppUser_AfterInstallingTheDebugger()
     {
-        var dockerfile = File.ReadAllText(Path.Combine(RepoRoot, "src", "DfE.CheckPerformanceData.Web", "Dockerfile"));
+        var dockerfile = File.ReadAllText(DockerfilePath("DfE.CheckPerformanceData.Web"));
         var stage = StageNamed(dockerfile, "debug-runtime");
 
-        var root = stage.IndexOf("USER root", StringComparison.Ordinal);
+        var users = UserMatches(stage);
         var install = stage.IndexOf("apt-get install", StringComparison.Ordinal);
-        var app = stage.LastIndexOf("USER $APP_UID", StringComparison.Ordinal);
+        var root = users.FirstOrDefault(m => m.Groups[1].Value == "root");
+        var app = users.LastOrDefault(m => m.Groups[1].Value == "$APP_UID");
 
         Assert.True(install >= 0, "the debug stage installs the debugger with apt-get");
-        Assert.True(root >= 0 && root < install, "the apt-get install needs root, so USER root must come before it");
-        Assert.True(app > install, "the stage must hand back to the app user after the install");
+        Assert.True(root is not null && root.Index < install, "the apt-get install needs root, so USER root must come before it");
+        Assert.True(app is not null && app.Index > install, "the stage must hand back to the app user after the install");
     }
 
     [Theory]
@@ -42,21 +61,30 @@ public void AksModule_EnforcesNonRoot(string module)
     {
         var tf = File.ReadAllText(Path.Combine(RepoRoot, "terraform", "application", "application.tf"));
 
-        Assert.Matches(new Regex(@"run_as_non_root\s*=\s*true"), ModuleBlock(tf, module));
+        Assert.Matches(new Regex(@"^[ \t]*run_as_non_root[ \t]*=[ \t]*true\b", RegexOptions.Multiline), ModuleBlock(tf, module));
     }
 
-    // The text of one build stage: from its `FROM … AS <name>` line to the next `FROM` or the end.
+    // The text of one build stage: its `FROM … AS <name>` line through to the next `FROM` or the end.
     private static string StageNamed(string dockerfile, string name)
     {
         var match = Regex.Match(
             dockerfile,
-            $@"^FROM .* AS {Regex.Escape(name)}[ \t]*\r?$(.*?)(?=^FROM |\z)",
+            $@"^FROM [^\r\n]* AS {Regex.Escape(name)}[ \t]*\r?$.*?(?=^FROM |\z)",
             RegexOptions.Multiline | RegexOptions.Singleline);
 
         Assert.True(match.Success, $"no stage named {name}");
-        return match.Groups[1].Value;
+        return match.Value;
     }
 
+    // Real USER directives only (anchored at line start), so a comment naming one never counts.
+    private static MatchCollection UserMatches(string stageText) =>
+        Regex.Matches(stageText, @"^[ \t]*USER[ \t]+(\S+)[ \t]*\r?$", RegexOptions.Multiline);
+
+    private static List<string> UserDirectives(string stageText) =>
+        UserMatches(stageText).Select(m => m.Groups[1].Value).ToList();
+
+    private static string DockerfilePath(string project) => Path.Combine(RepoRoot, "src", project, "Dockerfile");
+
     // The text of one `module "<name>" { … }` block, up to its closing brace at column 0.
     private static string ModuleBlock(string tf, string name)
     {