Skip to content

Update dockerfile to use a rootless user #837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update dockerfile to use a rootless user #837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e505e32
Add volume for node_modules
axelpontetto Sep 11, 2024
254e743
Update dockerfile to use a rootless user
axelpontetto Sep 16, 2024
beb9163
Merge branch 'main' into update-dockerfile-to-use-a-rootless-user
santib Oct 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 18 additions & 5 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,19 +61,32 @@
apt-get install --no-install-recommends -y curl libpq-dev libvips libjemalloc2 libyaml-dev && \
apt-get clean && rm -rf /var/lib/apt/lists/*

ENV USERNAME rails_api_base

Check warning on line 64 in Dockerfile

View workflow job for this annotation

GitHub Actions / docker

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this way we won't need to change if for all the projects 🙂

Suggested change
ENV USERNAME rails_api_base
ENV USERNAME rails

ENV USER_UID 1000

Check warning on line 65 in Dockerfile

View workflow job for this annotation

GitHub Actions / docker

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
ENV USER_GID 1000

Check warning on line 66 in Dockerfile

View workflow job for this annotation

GitHub Actions / docker

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
Comment on lines +64 to +66
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we use ENV or ARG here? 🤔 https://docs.docker.com/build/building/variables/

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At first I tried using ARG but I remember I had some issues with that. I will take another look.


# Create a rootless user.
RUN groupadd --gid $USER_GID $USERNAME && \
useradd --uid $USER_UID --gid $USER_GID -m $USERNAME

# Create app directory.
RUN mkdir -p "${APP_HOME}"
RUN mkdir -p "${APP_HOME}" && chown -R $USERNAME:$USERNAME $APP_HOME && chmod -R 700 $APP_HOME

Check failure on line 73 in Dockerfile

View workflow job for this annotation

GitHub Actions / Linters 

SC2086 info: Double quote to prevent globbing and word splitting.

# Change to the rootless user.
USER $USERNAME

# Setup work directory.
WORKDIR $APP_HOME

# Copy everything from the builder image
COPY --link . .
COPY --from=builder $APP_HOME/public/ $APP_HOME/public/
COPY --from=builder $APP_HOME/tmp/ $APP_HOME/tmp/
COPY --from=builder $APP_HOME/vendor/ $APP_HOME/vendor/
COPY --link --chown=$USERNAME:$USERNAME --chmod=700 . .
COPY --from=builder --chown=$USERNAME:$USERNAME --chmod=700 $APP_HOME/public/ $APP_HOME/public/
COPY --from=builder --chown=$USERNAME:$USERNAME --chmod=700 $APP_HOME/tmp/ $APP_HOME/tmp/
COPY --from=builder --chown=$USERNAME:$USERNAME --chmod=700 $APP_HOME/vendor/ $APP_HOME/vendor/

USER root
RUN ln -s /usr/lib/*-linux-gnu/libjemalloc.so.2 /usr/lib/libjemalloc.so.2
USER $USERNAME
Copy link
Contributor

@JulianPasquale JulianPasquale Sep 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tried moving this line up? I assume if we login using this username before running all the copy, we wouldn't need to specify the owner in the command

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I already tried that. Not sure if there is another workaround.


# Deployment options
ENV RAILS_LOG_TO_STDOUT=true
Expand Down
19 changes: 15 additions & 4 deletions Dockerfile.dev
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,24 +20,35 @@ ENV WORK_ROOT=/src
ENV APP_HOME=$WORK_ROOT/app/
ENV LANG=C.UTF-8

ENV USERNAME rails_api_base
ENV USER_UID 1000
ENV USER_GID 1000

# Create a rootless user.
RUN groupadd --gid $USER_GID $USERNAME && \
useradd --uid $USER_UID --gid $USER_GID -m $USERNAME

# Create app directory.
RUN mkdir -p $APP_HOME
RUN mkdir -p $APP_HOME && chown -R $USERNAME:$USERNAME $APP_HOME && chmod -R 700 $APP_HOME

# Change to the rootless user.
USER $USERNAME

# Setup work directory.
WORKDIR $APP_HOME

RUN gem install foreman bundler

# Copy dependencies files and install libraries.
COPY --link package.json yarn.lock .yarnrc.yml ./
COPY --link --chown=$USERNAME:$USERNAME --chmod=700 package.json yarn.lock .yarnrc.yml ./

RUN corepack enable
RUN yarn install --immutable && yarn cache clean

COPY --link Gemfile Gemfile.lock .ruby-version ./
COPY --link --chown=$USERNAME:$USERNAME --chmod=700 Gemfile Gemfile.lock .ruby-version ./
RUN bundle install -j 4

COPY --link . .
COPY --link --chown=$USERNAME:$USERNAME --chmod=700 . .

RUN yarn build

Expand Down