Security issue - Docker-compose persisted volumes

[Josh-XT]

I was just looking at the security tab and saw this warning. https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-x5gj-2chr-4ch6

I'm not sure if there is a reason but I noticed that the docker-compose.yml and Dockerfile as well as the rest of the whole directory is persisted in the docker-compose.yml file. You should pick and choose what directories need to be persisted locally. The whole folder should not be persisted. For example, if things in data and logs folders are the important things to save, persist those instead of the whole folder. If things are saving in the root of the project, I would consider a refactor.

https://github.com/Significant-Gravitas/AutoGPT/blob/180de0c9a9ce79939a8aae2b55d01e2bf2a5becb/autogpts/autogpt/docker-compose.yml#L14-L17

[ghost]

Replace this (persists everything)

• ./:/app

With this (persists only data and logs)

• ./data:/app/data
• ./logs:/app/logs

this should solve it

[ntindle]

Please open a pr to fix

[github-actions[bot]]

This issue has automatically been marked as stale because it has not had any activity in the last 50 days. You can unstale it by commenting or removing the label. Otherwise, this issue will be closed in 10 days.

[github-actions[bot]]

This issue was closed automatically because it has been stale for 10 days with no activity.