run assertoor as regular user

Author: pk910

Dockerfile

@@ -16,6 +16,13 @@ RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-reco
   make \
   sudo \
   && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /src/bin/assertoor /assertoor
-ENTRYPOINT ["/assertoor"]
+  && rm -rf /var/lib/apt/lists/* \
+  && update-ca-certificates
+RUN groupadd -g 10001 assertoor && useradd -m -u 10001 -g assertoor assertoor
+RUN echo "assertoor ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/assertoor
+WORKDIR /app
+COPY --from=builder /src/bin/* /app/
+RUN chown -R assertoor:assertoor /app/*
+USER assertoor
+ENTRYPOINT ["/app/assertoor"]
+

Dockerfile-local

@@ -19,8 +19,17 @@ RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-reco
   make \
   sudo \
   && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /src/bin/assertoor /assertoor
+  && rm -rf /var/lib/apt/lists/* \
+  && update-ca-certificates
+ARG userid=10001
+ARG groupid=10001
+RUN groupadd -g ${groupid} assertoor && useradd -m -u ${userid} -g assertoor assertoor
+RUN echo "assertoor ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/assertoor
+WORKDIR /app
+COPY --from=builder /src/bin/* /app/
+RUN chown -R assertoor:assertoor /app/*
 RUN mkdir /workspace
+USER assertoor
 WORKDIR /workspace
-ENTRYPOINT ["/assertoor"]
+EXPOSE 8080
+ENTRYPOINT ["/app/assertoor"]

Dockerfile-stub

@@ -1,7 +1,6 @@
 
 # final stage
 FROM debian:stable-slim
-WORKDIR /app
 RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
   libssl-dev \
   ca-certificates \
@@ -11,9 +10,14 @@ RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-reco
   make \
   sudo \
   && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-RUN update-ca-certificates
-COPY bin/* /app
+  && rm -rf /var/lib/apt/lists/* \
+  && update-ca-certificates
+RUN groupadd -g 10001 assertoor && useradd -m -u 10001 -g assertoor assertoor
+RUN echo "assertoor ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/assertoor
+WORKDIR /app
+COPY bin/* /app/
+RUN chown -R assertoor:assertoor /app/*
+USER assertoor
 EXPOSE 8080
 ENTRYPOINT ["./assertoor"]
 CMD []

Makefile

@@ -2,6 +2,8 @@
 VERSION := $(shell git rev-parse --short HEAD)
 GOLDFLAGS += -X 'github.com/ethpandaops/assertoor/pkg/coordinator/buildinfo.BuildVersion="$(VERSION)"'
 GOLDFLAGS += -X 'github.com/ethpandaops/assertoor/pkg/coordinator/buildinfo.BuildRelease="$(RELEASE)"'
+CURRENT_UID := $(shell id -u)
+CURRENT_GID := $(shell id -g)
 
 .PHONY: all docs test clean
 
@@ -27,8 +29,8 @@ devnet-run: devnet
 	go run main.go --config .hack/devnet/generated-assertoor-config.yaml
 
 devnet-run-docker: devnet
-	docker build --file ./Dockerfile-local -t assertoor:devnet-run .
-	docker run --rm -v $(PWD):/workspace -p 8080:8080 --network kt-assertoor -it assertoor:devnet-run --config .hack/devnet/generated-assertoor-config.yaml
+	docker build --file ./Dockerfile-local -t assertoor:devnet-run --build-arg userid=$(CURRENT_UID) --build-arg groupid=$(CURRENT_GID) .
+	docker run --rm -v $(PWD):/workspace -p 8080:8080 -u $(CURRENT_UID):$(CURRENT_GID) --network kt-assertoor -it assertoor:devnet-run --config .hack/devnet/generated-assertoor-config.yaml
 
 devnet-clean:
 	.hack/devnet/cleanup.sh