Harden Docker runtime image: run as non-root user

[CybotTM]

Background

SonarCloud flags the runtime stage of the Dockerfile as running with root as the default user (security hotspot, category: permission, MEDIUM).

Dockerfile:24 — This image might run with "root" as the default user. Make sure it is safe here.

Why this needs care (not a quick fix)

Ofelia communicates with the Docker socket (/var/run/docker.sock) to schedule and run jobs in containers. Adding a non-root USER to the image requires careful handling:

• The non-root user must be a member of a group whose GID matches the host's docker socket group, which varies per host — a hardcoded GID will break socket access on many systems.
• May need a documented --group-add / compose group_add runtime requirement.
• Needs verification that all job types (run, exec, local, compose) still work after the change.

Because socket access is environment-dependent, this is a non-trivial hardening task that needs design + testing across deployment scenarios, not a one-line USER directive.

Acceptance criteria

• Runtime image runs as a non-root user by default
• Docker socket access still works (documented group/GID handling)
• All job types verified (run/exec/local/compose)
• README/docs updated with any new runtime group requirement
• SonarCloud hotspot Dockerfile permission resolved

References

• SonarCloud project: https://sonarcloud.io/project/security_hotspots?id=netresearch_ofelia