Drop Stash to non privileged user in Docker container

.dockerignore

@@ -55,3 +55,5 @@ stash
 dist
 
 docker
+! docker/build/x86_64/alpine-entrypoint.sh
+! docker/build/x86_64/ubuntu-entrypoint.sh

docker/build/x86_64/Dockerfile

@@ -37,8 +37,9 @@ RUN make flags-release flags-pie stash
 
 # Final Runnable Image
 FROM alpine:latest
-RUN apk add --no-cache ca-certificates vips-tools ffmpeg
+RUN apk add --no-cache ca-certificates vips-tools ffmpeg su-exec
 COPY --from=backend /stash/stash /usr/bin/
-ENV STASH_CONFIG_FILE=/root/.stash/config.yml
+ENV STASH_CONFIG_FILE=/home/stash/.stash/config.yml
 EXPOSE 9999
-ENTRYPOINT ["stash"]
+COPY ./docker/build/x86_64/alpine-entrypoint.sh /usr/local/bin/set-user-entrypoint.sh
+ENTRYPOINT ["/usr/local/bin/set-user-entrypoint.sh", "stash"]

docker/build/x86_64/Dockerfile-CUDA

@@ -44,7 +44,9 @@ RUN apt update && apt upgrade -y && apt install -y \
     # intel dependencies
     intel-media-va-driver-non-free vainfo \
     # python tools
-    python3 python3-pip && \
+    python3 python3-pip \
+    # allow to run as non-root user
+    gosu && \
   # cleanup
   apt autoremove -y && apt clean && \
   rm -rf /var/lib/apt/lists/*
@@ -53,13 +55,14 @@ COPY --from=backend --chmod=555 /stash/stash /usr/bin/
 # NVENC Patch
 RUN mkdir -p /usr/local/bin /patched-lib
 ADD --chmod=555 https://raw.githubusercontent.com/keylase/nvidia-patch/master/patch.sh /usr/local/bin/patch.sh
-ADD --chmod=555 https://raw.githubusercontent.com/keylase/nvidia-patch/master/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+ADD --chmod=555 https://raw.githubusercontent.com/keylase/nvidia-patch/master/docker-entrypoint.sh /usr/local/bin/nvidia-patch-entrypoint.sh
 
 ENV LANG=C.UTF-8
 ENV NVIDIA_VISIBLE_DEVICES=all
 ENV NVIDIA_DRIVER_CAPABILITIES=video,utility
-ENV STASH_CONFIG_FILE=/root/.stash/config.yml
+ENV STASH_CONFIG_FILE=/home/stash/.stash/config.yml
 EXPOSE 9999
-ENTRYPOINT ["docker-entrypoint.sh", "stash"]
+COPY ./docker/build/x86_64/ubuntu-entrypoint.sh /usr/local/bin/set-user-entrypoint.sh
+ENTRYPOINT ["nvidia-patch-entrypoint.sh", "/usr/local/bin/set-user-entrypoint.sh", "stash"]
 
 # vim: ft=dockerfile

docker/build/x86_64/alpine-entrypoint.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+
+USER_ID=${LOCAL_UID:-1000}
+
+USER_NAME="$(getent passwd | awk -F: '$3 == '${USER_ID}' { print $1 }')"
+
+if [ "$USER_NAME" == "" ]; then
+  USER_NAME=stash
+
+  if [ -d "/home/${USER_NAME}" ]; then
+    ARGS='-H'
+  fi
+
+  adduser -D -s /bin/sh -u ${USER_ID} ${ARGS} "$USER_NAME"
+  export HOME="/home/${USER_NAME}"
+
+  chown ${USER_NAME} $HOME
+fi
+
+su-exec ${USER_NAME} "$@"

docker/build/x86_64/ubuntu-entrypoint.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+USER_ID=${LOCAL_UID:-1000}
+
+USER_NAME="$(getent passwd | awk -F: '$3 == '${USER_ID}' { print $1 }')"
+
+if [ "$USER_NAME" == "" ]; then
+  USER_NAME=stash
+
+  if [ ! -d "/home/{USER_NAME}" ]; then
+    ARGS='-m'
+  fi
+
+  useradd --shell /bin/bash -u "$USER_ID" $ARGS "$USER_NAME"
+  export HOME="/home/${USER_NAME}"
+
+  chown "$USER_NAME" $HOME
+fi
+
+gosu "$USER_NAME" "$@"

docker/production/docker-compose.yml

@@ -25,13 +25,15 @@ services:
       ## Set your timezone, e.g. America/New_York or Europe/Berlin
       ## see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
       - TZ=Etc/UTC
+      ## Set this to your local user id to ensure that files created by stash are owned by your user.
+      - LOCAL_UID=1000
     volumes:
       ## Adjust below paths (the left part) to your liking.
-      ## E.g. you can change ./config:/root/.stash to ./stash:/root/.stash
+      ## E.g. you can change ./config:/home/stash/.stash to ./stash:/home/stash/.stash
       ## The left part is the path on your host, the right part is the path in the stash container.
 
       ## Keep configs, scrapers, and plugins here.
-      - ./config:/root/.stash
+      - ./config:/home/stash/.stash
       ## Point this at your collection.
       ## The left side is where your collection is on your host, the right side is where it will be in stash.
       - ./data:/data