[Security] Run as non root

.github/workflows/build.yml

@@ -13,4 +13,8 @@ jobs:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v4      
       - name: Build & test  
-        run: make tests.docker
+        run: make builds
+      - name: Build & test
+        run: make builds
+      - name: Build docker
+        run: make docker

.github/workflows/docker.yml

@@ -19,9 +19,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Run tests in docker
-        run: make tests.docker
-
       - name: Log in to the Container registry
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
         with:

Makefile

@@ -44,9 +44,9 @@ tests: builds lints
 	# cd clientlib && $(MAKE) test -f ../Makefile
 
 tests.docker:
-	docker-compose -p testsenv build tests; \
-	docker-compose -p testsenv up --exit-code-from tests tests; ret=$$?; \
-	docker-compose -p testsenv down -v; exit $$ret;
+	docker compose -p testsenv build tests; \
+	docker compose -p testsenv up --exit-code-from tests tests; ret=$$?; \
+	docker compose -p testsenv down -v; exit $$ret;
 
 docker:
 	docker build -t etf1/kafka-message-scheduler:${VERSION} -f ./cmd/kafka/Dockerfile .

cmd/kafka/Dockerfile

@@ -1,11 +1,12 @@
-FROM golang:alpine as builder
+FROM golang:1.22-alpine3.21 AS builder
 RUN apk --no-cache update && apk --no-cache add gcc musl-dev git make bash
-WORKDIR /build
+WORKDIR /project
 COPY . .
-RUN GOOS=linux GOARCH=amd64 make bin
+RUN CGO_ENABLED=1 GOOS=linux GOARCH=amd64 make bin
 
-FROM alpine
+FROM alpine:3.21
 RUN apk --no-cache update
-WORKDIR /bin
-COPY --from=builder /build/bin/scheduler scheduler
+WORKDIR /project
+COPY --from=builder /project/scheduler scheduler
+USER 1001
 CMD ["./scheduler"]