Apply some good security practices

Dockerfile

@@ -1,5 +1,4 @@
 FROM golang:1.20-alpine AS builder
-
 WORKDIR /go/src/webhook-app
 COPY . .
 RUN --mount=type=cache,target=$HOME/go/pkg/mod go mod download
@@ -9,9 +8,19 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /webhook-app -ldflags '-w -extldflags "-static"' .
 
 FROM alpine:3
+ENV USER=godaddyWebhook
+ENV UID=2050
+ENV GID=2050
+
+RUN addgroup --system --gid ${GID} ${USER}
+
+RUN adduser --system --disabled-password --home /home/${USER} \
+    --uid ${UID} --ingroup ${USER} ${USER}
 
 RUN apk add --no-cache git ca-certificates
 
 COPY --from=builder /webhook-app /usr/local/bin/webhook
+RUN chown -R ${UID}:${GID} /usr/local/bin/webhook
+USER ${UID}
 
 ENTRYPOINT ["webhook"]

deploy/charts/godaddy-webhook/templates/deployment.yaml

@@ -25,6 +25,16 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            runAsGroup: 2050
+            runAsNonRoot: true
+            runAsUser: 2050
+            seccompProfile:
+              type: RuntimeDefault
           args:
             - --tls-cert-file=/tls/tls.crt
             - --tls-private-key-file=/tls/tls.key