Run as non-root

Closes #196

docker/Dockerfile

@@ -154,6 +154,9 @@ LABEL org.opencontainers.image.created=$BUILD_DATE
 ARG GITREF=unknown
 LABEL org.opencontainers.image.revision=$GITREF
 
+ARG USERID=10001
+ARG GROUPID=10001
+USER ${USERID}:${GROUPID}
 
 ##################################################
 #
@@ -173,3 +176,7 @@ RUN --mount=type=cache,target=/root/.cache \
 
 # Override ENTRYPOINT rather than CMD so we can pass arbitrary commands to the entrypoint script
 ENTRYPOINT ["/app/docker/entrypoints/dev.sh"]
+
+ARG USERID
+ARG GROUPID
+USER ${USERID}:${GROUPID}

docker/docker-compose.yaml

@@ -44,11 +44,17 @@ services:
     build:
       # the dev stage in the Dockerfile
       target: actions-registry-dev
+      # pass the uid/gid as build arg
+      args:
+        - USERID=${DEV_USERID:-1000}
+        - GROUPID=${DEV_GROUPID:-1000}
     # paths relative to docker-compose.yaml file
     env_file:
       - ../.env
     volumes:
       - ..:/app
+      # provides a persistant inspectable cache for staticfiles
+      - ./staticfiles:/opt/staticfiles
     # override command
     command: python manage.py runserver 0.0.0.0:8000
 

docker/justfile

@@ -1,9 +1,9 @@
-export DOCKER_USERID := `id -u`
-export DOCKER_GROUPID := `id -g`
-
 # Load .env files by default
 set dotenv-load := true
 
+export DEV_USERID := `id -u`
+export DEV_GROUPID := `id -g`
+
 # enable modern docker build features
 export DOCKER_BUILDKIT := "1"
 export COMPOSE_DOCKER_CLI_BUILD := "1"