Security issue - Docker-compose persisted volumes

[Josh-XT]

I was just looking at the security tab and saw this warning. GHSA-x5gj-2chr-4ch6

I'm not sure if there is a reason but I noticed that the docker-compose.yml and Dockerfile as well as the rest of the whole directory is persisted in the docker-compose.yml file. You should pick and choose what directories need to be persisted locally. The whole folder should not be persisted. For example, if things in data and logs folders are the important things to save, persist those instead of the whole folder. If things are saving in the root of the project, I would consider a refactor.

AutoGPT/autogpts/autogpt/docker-compose.yml

Lines 14 to 17 in 180de0c

	volumes:
	- ./:/app
	- ./docker-compose.yml:/app/docker-compose.yml:ro
	- ./Dockerfile:/app/Dockerfile:ro

[Albiere1]

Replace this (persists everything)

• ./:/app

With this (persists only data and logs)

• ./data:/app/data
• ./logs:/app/logs

this should solve it