Drop Stash to non privileged user in Docker container

[aserv92]

Description

Add option to run Stash as a non-root user from Docker containers perspective and generated files to be owned by the specified user.

Related Issue

#684

Testing

1. Build the docker container with make docker-build

• There was an issue with the pnpm configuration/version (unrelated) so I temporarily bypassed it by adding RUN corepack enable to the build front end stage of the Docker build

2. Switched to the docker/production directory
3. Executed mkdir blobs cache config data generated metadata (see explanation in additional context)
4. Temporarily mapped the data volume in the docker compose yml to my home directory
5. Temporarily updated the image in docker compose yml to docker.io/stash/build:latest
6. Executed docker compose up
7. logged in with the browser on local port 9999
8. Configured the application
9. Scanned for my movies directory -> ok, movies loaded
10. Verified files are not owned by root and that they are owned by me from my perspective.
11. Verified files are owned by stash from the containers perspective

I also executed make docker-cuda-build to build and test the Cuda build then followed the exact same steps.
its worth mentioning that the build failed for the pnpm version mismatch so I temporarily fixed the same way I fixed it in the non Cuda test. Also the image golang:1.25.9-bullseye does not exist at the time of making this PR so I updated the cuda build to use golang:1.25.9-trixie as the backend base.

Ahhh. Yes, from the Cuda containers perspective ubuntu owns the files generated by stash instead of stash. This is because my host user is user 1000 and the base ubuntu container already has user 1000 and is named ubuntu it skipped creating the stash user with ID 1000 because the ubuntu user already exists and has user id 1000. This is expected behavior. I'll change the user id in the compose yml to user id 1005 and upload one more screen shot. You will see now from the container perspective the stash files are owned by stash and from my perspective the files are owned by undefined user 1005 because my local system doesn't have a user 1005.

See diff used for testing

This is how I tested the changes. I didn't want to include these changes in the PR as they are unrelated to the issue.

diff --git a/docker/build/x86_64/Dockerfile b/docker/build/x86_64/Dockerfile
index 124ea8d0..bb9dcf30 100644
--- a/docker/build/x86_64/Dockerfile
+++ b/docker/build/x86_64/Dockerfile
@@ -11,6 +11,7 @@ COPY ./graphql /stash/graphql/
 COPY ./ui /stash/ui/
 # pnpm install with npm
 RUN npm install -g pnpm
+RUN corepack enable
 RUN make pre-ui
 RUN make generate-ui
 ARG GITHASH
diff --git a/docker/build/x86_64/Dockerfile-CUDA b/docker/build/x86_64/Dockerfile-CUDA
index 98b66b66..6a8bcdf6 100644
--- a/docker/build/x86_64/Dockerfile-CUDA
+++ b/docker/build/x86_64/Dockerfile-CUDA
@@ -12,6 +12,7 @@ COPY ./graphql /stash/graphql/
 COPY ./ui /stash/ui/
 # pnpm install with npm
 RUN npm install -g pnpm
+RUN corepack enable
 RUN make pre-ui
 RUN make generate-ui
 ARG GITHASH
@@ -19,7 +20,7 @@ ARG STASH_VERSION
 RUN BUILD_DATE=$(date +"%Y-%m-%d %H:%M:%S") make ui-only
 
 # Build Backend
-FROM golang:1.25.9-bullseye AS backend
+FROM golang:1.25.9-trixie AS backend
 RUN apt update && apt install -y build-essential golang
 WORKDIR /stash
 COPY ./go* ./*.go Makefile gqlgen.yml .gqlgenc.yml /stash/
diff --git a/docker/production/docker-compose.yml b/docker/production/docker-compose.yml
index 4efcd94c..21f291bf 100644
--- a/docker/production/docker-compose.yml
+++ b/docker/production/docker-compose.yml
@@ -2,7 +2,7 @@
 # APPDESCRIPTION=An organizer for your porn, written in Go
 services:
   stash:
-    image: stashapp/stash:latest
+    image: docker.io/stash/cuda-build:latest
     container_name: stash
     restart: unless-stopped
     ## the container's port must be the same with the STASH_PORT in the environment section
@@ -26,7 +26,7 @@ services:
       ## see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
       - TZ=Etc/UTC
       ## Set this to your local user id to ensure that files created by stash are owned by your user.
-      - LOCAL_UID=1000
+      - LOCAL_UID=1005
     volumes:
       ## Adjust below paths (the left part) to your liking.
       ## E.g. you can change ./config:/home/stash/.stash to ./stash:/home/stash/.stash
@@ -36,7 +36,7 @@ services:
       - ./config:/home/stash/.stash
       ## Point this at your collection.
       ## The left side is where your collection is on your host, the right side is where it will be in stash.
-      - ./data:/data
+      - $HOME:/data
       ## This is where your stash's metadata lives
       - ./metadata:/metadata
       ## Any other cache content.

Screenshots

Checklist

• I have read and understood the Contributing document.
• I have read and understood the AI Usage Policy document.
• I have made corresponding changes to the documentation (if applicable).

AI Usage Disclosure

• I have used AI tools to assist with this pull request, and I have disclosed the tools and how I used them below.

Additional Context

It is worth mentioning that when we mount a local directory as a volume, if it doesn't exist before docker creates the container docker (using it's own permission, generally root) will create the directory. This is also expected docker behavior. So the directories need to exist before docker starts the container otherwise root will own the directories then stash will fail to put files in the directories as stash is now running as non root and can not manipulate files in directories owned by root.

I understand there are concerns about not be able to run as root breaking things. These changes to the docker builds do allow running stash as root as well.

Although if your worried about breaking current installs/setups/workflows then I can update this PR to run the container as root by default. But I think that leaves security vulnerabilities on the table as does anything running with unnecessary elevated privileges.

Yes I am bounty hunting, but I am human. No AI was used to make this PR.

[aserv92]

@DogmaDragon I would like to request review from the code owner. But seems i'm not allowed to.

[aserv92]

I closed this PR as no review was left and there is no way to move forward with this PR.