From bd7d4f3c5fcebcb4ea306a35d451924055bb6d6d Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Fri, 22 May 2026 15:00:04 +0000 Subject: [PATCH] build: run brewlog as non-root user 1000:1000 Add brewlog user/group (UID/GID 1000) to chiseled rootfs via base-passwd_data slice and useradd. Set USER 1000:1000 in the runtime stage. Requires a one-time remediation deploy (with gosu + chown entrypoint) to fix existing volume permissions before this can be used. --- Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index af310b9..4393a27 100644 --- a/Dockerfile +++ b/Dockerfile @@ -43,17 +43,22 @@ RUN curl -sL "https://github.com/canonical/chisel/releases/download/v1.4.1/chise RUN mkdir /rootfs && chisel cut --root /rootfs \ base-files_base \ base-files_release-info \ + base-passwd_data \ ca-certificates_data \ libgcc-s1_libs \ libc6_libs \ libssl3t64_libs \ openssl_bins +RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \ + && mkdir -p /rootfs/home/brewlog /rootfs/data \ + && chown 1000:1000 /rootfs/home/brewlog /rootfs/data + # --------------------------------------------------------------------------- # Runtime — scratch with chisel rootfs # --------------------------------------------------------------------------- FROM scratch COPY --from=chisel /rootfs / COPY --from=builder /out/brewlog /usr/local/bin/brewlog -USER 65534:65534 +USER 1000:1000 ENTRYPOINT ["brewlog", "serve", "--database-url", "sqlite:///data/brewlog.db"]