moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: run brewlog as non-root user 1000:1000

Browse source 
Add brewlog user/group (UID/GID 1000) to chiseled rootfs via
base-passwd_data slice and useradd. Set USER 1000:1000 in the
runtime stage. Requires a one-time remediation deploy (with
gosu + chown entrypoint) to fix existing volume permissions
before this can be used.
This commit is contained in:
Jon Seager 2026-05-22 15:00:04 +00:00
parent 1d2b071fe9
commit bd7d4f3c5f
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
Dockerfile
View file

@ -43,17 +43,22 @@ RUN curl -sL "https://github.com/canonical/chisel/releases/download/v1.4.1/chise
RUN mkdir /rootfs && chisel cut --root /rootfs \ RUN mkdir /rootfs && chisel cut --root /rootfs \
base-files_base \ base-files_base \
base-files_release-info \ base-files_release-info \
base-passwd_data \
ca-certificates_data \ ca-certificates_data \
libgcc-s1_libs \ libgcc-s1_libs \
libc6_libs \ libc6_libs \
libssl3t64_libs \ libssl3t64_libs \
openssl_bins openssl_bins
RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
&& mkdir -p /rootfs/home/brewlog /rootfs/data \
&& chown 1000:1000 /rootfs/home/brewlog /rootfs/data
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
# Runtime — scratch with chisel rootfs # Runtime — scratch with chisel rootfs
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
FROM scratch FROM scratch
COPY --from=chisel /rootfs / COPY --from=chisel /rootfs /
COPY --from=builder /out/brewlog /usr/local/bin/brewlog COPY --from=builder /out/brewlog /usr/local/bin/brewlog
USER 65534:65534 USER 1000:1000
ENTRYPOINT ["brewlog", "serve", "--database-url", "sqlite:///data/brewlog.db"] ENTRYPOINT ["brewlog", "serve", "--database-url", "sqlite:///data/brewlog.db"]