Use non root for containers

luigi311 · Nov 13, 2023 · d607c9c · d607c9c
1 parent f6b2186
commit d607c9c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 4 deletions.
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
@@ -32,12 +32,20 @@ ENV WHITELIST_LIBRARY_TYPE  ''
 ENV BLACKLIST_USERS  ''
 ENV WHITELIST_USERS  ''
 
+
+RUN addgroup --system jellyplex_user && \
+    adduser --system --no-create-home jellyplex_user --ingroup jellyplex_user && \
+    mkdir -p /app && \
+    chown -R jellyplex_user:jellyplex_user /app
+
 WORKDIR /app
 
-COPY ./requirements.txt ./
+COPY --chown=jellyplex_user:jellyplex_user ./requirements.txt ./
 
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY --chown=jellyplex_user:jellyplex_user . .
+
+USER jellyplex_user
 
 CMD ["python", "-u", "main.py"]
diff --git a/Dockerfile.slim b/Dockerfile.slim
@@ -32,12 +32,20 @@ ENV WHITELIST_LIBRARY_TYPE  ''
 ENV BLACKLIST_USERS  ''
 ENV WHITELIST_USERS  ''
 
+
+RUN addgroup --system jellyplex_user && \
+    adduser --system --no-create-home jellyplex_user --ingroup jellyplex_user && \
+    mkdir -p /app && \
+    chown -R jellyplex_user:jellyplex_user /app
+
 WORKDIR /app
 
-COPY ./requirements.txt ./
+COPY --chown=jellyplex_user:jellyplex_user ./requirements.txt ./
 
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY --chown=jellyplex_user:jellyplex_user . .
+
+USER jellyplex_user
 
 CMD ["python", "-u", "main.py"]