Don't run app as root in Docker container

inspired by gitlabform/gitlabform#719 by @lkwg82 (thanks!)
voxpupuli · Apr 15, 2024 · 17caf4a · 17caf4a
1 parent f9a52d5
commit 17caf4a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -24,4 +24,7 @@ RUN pip install --no-cache-dir -r requirements-docker.txt .
 
 COPY Dockerfile /
 
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+USER appuser
+
 CMD gunicorn -b ${PUPPETBOARD_HOST}:${PUPPETBOARD_PORT} --preload --workers="${PUPPETBOARD_WORKERS:-1}" -e SCRIPT_NAME="${PUPPETBOARD_URL_PREFIX:-}" --access-logfile=- puppetboard.app:app