goosefoot
Stream beets imports over HTTP.
Star 1
Fork 1
Watch

fix(container): run container image as non-root user 1000:1000 #23

Merged glerp.sullen.net
targeting main from glerp.sullen.net/goosefoot:fix/container-nonroot-user
Merged opened by and assigned to glerp.sullen.net
targeting main from glerp.sullen.net/goosefoot:fix/container-nonroot-user

Summary #

Run the container image as non-root user 1000:1000 by default instead of root.

  • docker.io/linuxserver/beets normally drops privileges inside its s6 /init entrypoint via PUID/PGID, which is bypassed by ENTRYPOINT ["/usr/local/bin/goosefoot"].
  • Set USER 1000:1000 in the final runtime stage of Containerfile so the daemon, beet subprocesses, and post-import hooks execute unprivileged out of the box (while still allowing operators to override via --user / user:).
  • Document the fix under ## [Unreleased] in CHANGELOG.md.

Testing #

  • gofmt -l .
  • go vet ./...
  • go test -race -count=1 ./...
Commits 0