v1.2.6 release notes

Release Date: 2025-12-14 Type: Container Optimization Release

Summary

This release optimizes the web application Dockerfile by switching to the smaller nginx:1.29-alpine-slim base image and fixes non-root permission issues specific to the alpine-slim variant. The alpine-slim image provides a reduced attack surface with minimal packages while maintaining full functionality for serving the CyberChef web application.

Changes

nginx Base Image Optimization

The web application Dockerfile now uses nginx:1.29-alpine-slim instead of nginx:stable-alpine:

# Before (v1.2.5)
FROM nginx:stable-alpine AS cyberchef

# After (v1.2.6)
FROM nginx:1.29-alpine-slim AS cyberchef

Benefits:

• Smaller image size: alpine-slim variant includes only essential packages
• Reduced attack surface: Fewer packages means fewer potential vulnerabilities
• Explicit version pinning: 1.29 ensures reproducible builds (no surprise updates)
• Security hardened: Minimal base image follows container security best practices

Non-Root Permission Fixes

The alpine-slim variant has stricter default permissions than standard alpine, requiring explicit setup for non-root nginx execution:

# Security: Set proper ownership for nginx user and cache directories
# The alpine-slim variant requires explicit cache directory setup for non-root execution
RUN chown -R nginx:nginx /usr/share/nginx/html && \
    chmod -R 755 /usr/share/nginx/html && \
    mkdir -p /var/cache/nginx/client_temp \
             /var/cache/nginx/proxy_temp \
             /var/cache/nginx/fastcgi_temp \
             /var/cache/nginx/uwsgi_temp \
             /var/cache/nginx/scgi_temp && \
    chown -R nginx:nginx /var/cache/nginx && \
    chown -R nginx:nginx /var/run && \
    chown -R nginx:nginx /run

Fixed Issues:

1. nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
2. nginx: [emerg] open() "/run/nginx.pid" failed (13: Permission denied)

Root Cause: The nginx:alpine-slim variant does not pre-create nginx cache directories or configure permissions for non-root execution by default.

Technical Details

Cache Directory Structure

nginx requires the following cache directories for operation:

• /var/cache/nginx/client_temp - Client body buffering
• /var/cache/nginx/proxy_temp - Proxy response buffering
• /var/cache/nginx/fastcgi_temp - FastCGI response buffering
• /var/cache/nginx/uwsgi_temp - uWSGI response buffering
• /var/cache/nginx/scgi_temp - SCGI response buffering

These directories must be created and owned by the nginx user for non-root execution.

PID File Location

nginx writes its process ID to /run/nginx.pid (symlinked from /var/run/nginx.pid on Alpine). The nginx user must have write access to /run for the PID file.

Changed Files

File	Change
Dockerfile	Changed base image from nginx:stable-alpine to nginx:1.29-alpine-slim
Dockerfile	Added explicit mkdir for nginx cache directories
Dockerfile	Added chown for /var/run and /run directories
package.json	mcpVersion bumped to 1.2.6
src/node/mcp-server.mjs	Version constant updated to 1.2.6
README.md	Version references updated to v1.2.6
docs/user_guide.md	Download URLs updated to v1.2.6
SECURITY.md	Security measures section updated to v1.2.6
docs/planning/ROADMAP.md	Added v1.2.6 to release overview
CHANGELOG.md	v1.2.6 release notes added

Upgrade Instructions

From v1.2.5

# Pull latest MCP server image
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6

# Or download offline tarball
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.2.6/cyberchef-mcp-v1.2.6-docker-image.tar.gz
docker load < cyberchef-mcp-v1.2.6-docker-image.tar.gz

Rebuild Web Application Image

If using the web application Dockerfile:

docker build -t cyberchef-web .
docker run -p 8080:80 cyberchef-web

Verify Non-Root Execution

# Verify nginx user in web app container
docker run --rm cyberchef-web id
# Expected: uid=101(nginx) gid=101(nginx) groups=101(nginx)

# Verify MCP server non-root user
docker run --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6 id
# Expected: uid=1001(cyberchef) gid=1001(cyberchef)

Breaking Changes

None. This release is fully backward compatible with v1.2.5.

Security Considerations

nginx:alpine-slim vs nginx:alpine

Aspect	nginx:alpine	nginx:alpine-slim
Image Size	~40MB	~12MB
Packages	Full Alpine base	Minimal essential only
Attack Surface	Standard	Reduced
Shell	/bin/sh included	/bin/sh included
Package Manager	apk included	apk not included

The slim variant provides security through minimization - fewer packages means fewer potential vulnerabilities and less to patch.

Recommended Security Options

For maximum security, run with all hardening options:

docker run -i --rm \
  --read-only \
  --tmpfs /tmp:size=100M \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6

Links

• Release Tag: v1.2.6
• Docker Image: ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.6
• SBOM: Attached to release as sbom.cyclonedx.json
• Security Policy: SECURITY.md

Full Changelog

Full Changelog: v1.2.5…v1.2.6