fix: implement non-root user in Docker containers

- Add appuser (UID 1000) in builder stage
- Copy passwd file to scratch image
- Use USER directive to run as non-root user
- Fix docker-compose.yml to use YAML anchors properly
- Add Dockerfile.dev for development with shell access
- Addresses PR review comment about security

Author: kjanat

Dockerfile

@@ -4,6 +4,9 @@ FROM golang:1.23-alpine AS builder
 # Install git and ca-certificates (needed for fetching dependencies and HTTPS)
 RUN apk add --no-cache git ca-certificates tzdata
 
+# Create a non-root user for the final stage
+RUN adduser -D -u 1000 appuser
+
 # Set the working directory
 WORKDIR /app
 
@@ -36,11 +39,14 @@ COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 # Copy timezone data
 COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 
+# Add a minimal /etc/passwd file to support non-root user
+COPY --from=builder /etc/passwd /etc/passwd
+
 # Copy the binary
 COPY --from=builder /app/articulate-parser /articulate-parser
 
-# Create a non-root user (note: in scratch image, we can't create users dynamically)
-# The binary will run as root in scratch, which is acceptable for containers
+# Switch to non-root user (appuser with UID 1000)
+USER appuser
 
 # Set the binary as entrypoint
 ENTRYPOINT ["/articulate-parser"]

Dockerfile.dev

@@ -0,0 +1,63 @@
+# Development Dockerfile with shell access
+# Uses Alpine instead of scratch for debugging
+
+# Build stage - same as production
+FROM golang:1.23-alpine AS builder
+
+# Install git and ca-certificates (needed for fetching dependencies and HTTPS)
+RUN apk add --no-cache git ca-certificates tzdata
+
+# Create a non-root user
+RUN adduser -D -u 1000 appuser
+
+# Set the working directory
+WORKDIR /app
+
+# Copy go mod files
+COPY go.mod go.sum ./
+
+# Download dependencies
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Build the application
+# Disable CGO for a fully static binary
+# Use linker flags to reduce binary size and embed version info
+ARG VERSION=dev
+ARG BUILD_TIME
+ARG GIT_COMMIT
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+    -ldflags="-s -w -X github.com/kjanat/articulate-parser/internal/version.Version=${VERSION} -X github.com/kjanat/articulate-parser/internal/version.BuildTime=${BUILD_TIME} -X github.com/kjanat/articulate-parser/internal/version.GitCommit=${GIT_COMMIT}" \
+    -o articulate-parser \
+    ./main.go
+
+# Development stage - uses Alpine for shell access
+FROM alpine:3.19
+
+# Install minimal dependencies
+RUN apk add --no-cache ca-certificates tzdata
+
+# Copy the binary
+COPY --from=builder /app/articulate-parser /articulate-parser
+
+# Copy the non-root user configuration
+COPY --from=builder /etc/passwd /etc/passwd
+
+# Switch to non-root user
+USER appuser
+
+# Set the binary as entrypoint
+ENTRYPOINT ["/articulate-parser"]
+
+# Default command shows help
+CMD ["--help"]
+
+# Add labels for metadata
+LABEL org.opencontainers.image.title="Articulate Parser (Dev)"
+LABEL org.opencontainers.image.description="Development version of Articulate Parser with shell access"
+LABEL org.opencontainers.image.vendor="kjanat"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.source="https://github.com/kjanat/articulate-parser"
+LABEL org.opencontainers.image.documentation="https://github.com/kjanat/articulate-parser/blob/master/README.md"

docker-compose.yml

@@ -1,5 +1,5 @@
 services:
-  articulate-parser:
+  articulate-parser: &articulate-parser
     build:
       context: .
       dockerfile: Dockerfile
@@ -19,15 +19,21 @@ services:
 
   # Service for processing files with volume mounts
   parser-with-files:
-    extends: articulate-parser
+    <<: *articulate-parser
     volumes:
       - ./input:/input:ro
       - ./output:/output
     command: ["/input/sample.json", "markdown", "/output/result.md"]
 
   # Service for development - with shell access
   parser-dev:
-    extends: articulate-parser
+    build:
+      context: .
+      dockerfile: Dockerfile.dev
+    image: articulate-parser:dev
+    volumes:
+      - .:/workspace
+    working_dir: /workspace
     entrypoint: ["/bin/sh"]
     command: ["-c", "while true; do sleep 30; done"]
-    # This won't work with scratch image, but useful for debugging builds
+    # Uses Dockerfile.dev with Alpine base instead of scratch for shell access