[#31] Debug build is now rootless

docker/Dockerfile.builder

@@ -1,17 +1,35 @@
+# vim: filetype=dockerfile
 # Our entire toolchain runs in alpine
 FROM alpine:latest AS builder
 
-ENV PATH "$PATH:/root/.cargo/bin"
+ENV PATH "$PATH:/app/.cargo/bin"
 # Needed for proper compiling of openssl-dev
 ENV RUSTFLAGS "-C target-feature=-crt-static"
 
-WORKDIR /usr/src/app
+# Add the build user
+# Install dependencies
+RUN addgroup -S builder && \
+    adduser -S builder -G builder -h /app && \
+    apk update && \
+    apk add --no-cache \
+        curl \
+        gcc \
+        libgcc \
+        musl-dev \
+        openssl-dev \
+        postgresql-dev
 
-# Install build dependencies, rustup & rust's nightly build & toolchain
-RUN apk update && apk add --no-cache openssl-dev curl postgresql-dev libgcc musl-dev gcc && \
-    { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly; } && \
-    rustup target add x86_64-unknown-linux-musl --toolchain nightly
+# Switch to the non-root user
+USER builder
+
+WORKDIR /app
+
+# Install rustup in the new user's home
+# Create mountpoints for volumes with correct permissions
+RUN { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly; } && \
+    rustup target add x86_64-unknown-linux-musl --toolchain nightly && \
+    mkdir -p .cargo/registry target
 
 # Copy source code over to builder
-COPY Cargo.toml Cargo.lock ./
-COPY src/ ./src/
+COPY --chown=builder:builder Cargo.toml Cargo.lock ./
+COPY --chown=builder:builder src/ ./src/

docker/Dockerfile.dev

@@ -1,8 +1,9 @@
+# vim: filetype=dockerfile
 FROM chewingbever/fej-builder:latest
 
 ENV RUST_BACKTRACE 1
 
-COPY ./docker/entrypoint_dev.sh /entrypoint.sh
+COPY --chown=builder:builder ./docker/entrypoint_dev.sh /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["run", "--bin", "server"]

docker/Dockerfile.rel

@@ -1,3 +1,4 @@
+# vim: filetype=dockerfile
 FROM chewingbever/fej-builder:latest AS builder
 
 # And then finally, build the project