Merge pull request #755 from Sedetius/rootles-docker

[Docker] kiwix-serve image to use unprivileged user

Author: kelson42

docker/Dockerfile

@@ -1,5 +1,5 @@
 FROM alpine:3.18
-LABEL org.opencontainers.image.source https://github.com/openzim/kiwix-tools
+LABEL org.opencontainers.image.source=https://github.com/openzim/kiwix-tools
 
 # TARGETPLATFORM is injected by docker build
 ARG TARGETPLATFORM

docker/server/Dockerfile

@@ -2,13 +2,17 @@ ARG VERSION=latest
 
 # kiwix-tools is multi-arch
 FROM ghcr.io/kiwix/kiwix-tools:$VERSION
-LABEL org.opencontainers.image.source https://github.com/openzim/kiwix-tools
+LABEL org.opencontainers.image.source=https://github.com/openzim/kiwix-tools
 
 # expose kiwix-serve default port and workdir
 EXPOSE 8080
 VOLUME /data
 WORKDIR /data
 
+# running as a named unprivileged user
+RUN addgroup -S user && adduser -S user -G user
+USER user
+
 COPY ./start.sh /usr/local/bin/
 
 ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/start.sh"]