Dockerfile security issues about docker

[sle-odoo]

Hello,
Thanks for your feedback.

First, could we add checksums for the two insecure http downloads? wkhtmltox.deb and odoo.deb are not verified, and they are downloaded in-the-clear.

It is true that we do not check the deb file, but we correctly check wkhtmltopdf.

Second, could we download all required packages directly from debian and then run odoo completely unprivileged?

It is the case, we run the process with the odoo user created by the deb and all the dependencies are downloaded from debian, also thanks to the deb.

[ToBeReplaced]

Ah yes, thanks. Reviewing the .deb is sufficient for my requirements so long as it is pegged (we add a checksum). I missed that for wkhtmltopdf; thanks.

So now the only reason this issue is open is because of wanting a check on odoo.deb.

[aab-odoo]

Fixed by ad90fca.

Regards