When Dockerfile (or build scripts) use build-args/variables to choose target directories for chown/chmod, validate those paths at build time and fail if they target sensitive directories. This prevents overly-permissive ownership (e.g., group 0 write access) from becoming reachable via undocumented/override knobs.
Apply this rule by adding a guard or assertion before any recursive ownership/permission changes. For example:
ARG APP_DIR=/app/data
# Fail build if a dangerous directory is selected (adjust allowlist/prefix as needed)
RUN case "$APP_DIR" in \
/app|/app/*) echo "Refusing insecure APP_DIR=$APP_DIR" >&2; exit 1 ;; \
esac
RUN chown -R appuser:0 "$APP_DIR" && chmod -R g=rwX "$APP_DIR"
Also prefer explicit allowlists (or “path must start with /app/data”) over implicit assumptions about defaults; don’t rely on the variable being “theoretical” or undocumented to avoid security regressions.