Merge pull request #18 from SylivanKenobi/feature/rootless-image

change file permissions, start as nobody
daya0576 · Nov 19, 2024 · 9d31ca2 · 9d31ca2
2 parents d144fc7 + f30596d
commit 9d31ca2
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -25,4 +25,9 @@ COPY start.sh .
 COPY beaverhabits ./beaverhabits
 COPY statics ./statics
 
+RUN chmod -R g+w /app && \
+    chown -R nobody /app
+
+USER nobody
+
 CMD ["sh", "start.sh", "prd"]
diff --git a/Dockerfile.buildkit.arm32 b/Dockerfile.buildkit.arm32
@@ -32,4 +32,9 @@ COPY start.sh .
 COPY beaverhabits ./beaverhabits
 COPY statics ./statics
 
+RUN chmod -R g+w /app && \
+    chown -R nobody /app
+
+USER nobody
+
 CMD ["sh", "start.sh", "prd"]
diff --git a/Dockerfile.nobuildkit.arm32 b/Dockerfile.nobuildkit.arm32
@@ -33,4 +33,9 @@ COPY start.sh .
 COPY beaverhabits ./beaverhabits
 COPY statics ./statics
 
+RUN chmod -R g+w /app && \
+    chown -R nobody /app
+
+USER nobody
+
 CMD ["sh", "start.sh", "prd"]