Run inside container as unprivileged user

milgradesec · Sep 4, 2021 · 55c3d60 · 55c3d60
1 parent 773c5e3
commit 55c3d60
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 4 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,10 +1,16 @@
 FROM alpine:3.14.2
 
-RUN apk update && apk add --no-cache ca-certificates 
+RUN apk update && \
+    apk add --no-cache ca-certificates && \
+    addgroup -S ddns && \
+    adduser -S -G ddns ddns
 
 FROM scratch
 
 COPY --from=0 /etc/ssl/certs /etc/ssl/certs
+COPY --from=0 /etc/passwd /etc/passwd
 
 ADD ddns /ddns
+
+USER ddns
 ENTRYPOINT ["/ddns"]
diff --git a/build.Dockerfile b/build.Dockerfile
@@ -11,13 +11,15 @@ RUN make build SYSTEM="GOOS=${TARGETOS} GOARCH=${TARGETARCH}"
 
 FROM alpine:3.14.2
 
-RUN apk --update --no-cache add ca-certificates \
-    && addgroup -g 1000 ddns \
-    && adduser -u 1000 -G ddns -s /sbin/nologin -D ddns
+RUN apk --update --no-cache add ca-certificates && \
+    addgroup -S ddns && \
+    adduser -S -G ddns ddns
 
 FROM scratch
 
 COPY --from=0 /go/src/app/ddns /ddns
 COPY --from=1 /etc/ssl/certs /etc/ssl/certs
+COPY --from=1 /etc/passwd /etc/passwd
 
+USER ddns
 ENTRYPOINT ["/ddns"]