build: make docker image root-less (#556)

* build: make docker root-less * build: bump to 2.4.19-rc.1 * build: switch to 8080 port * build: change version to 2.4.19 --------- Co-authored-by: Caouissin Laurent <[email protected]>
InseeFr · May 3, 2024 · 1498145 · 1498145
1 parent a14be3b
commit 1498145
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 8 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,13 +1,21 @@
-FROM nginx
-RUN rm -rf /usr/share/nginx/html/*
+FROM nginxinc/nginx-unprivileged:1.25-alpine
 
-ADD build /usr/share/nginx/html
+# Non root user
+ENV NGINX_USER_ID=101
+ENV NGINX_GROUP_ID=101
+ENV NGINX_USER=nginx
 
-RUN rm etc/nginx/conf.d/default.conf
-COPY ./nginx.conf /etc/nginx/conf.d/
+USER $NGINX_USER_ID
+
+# Add build to nginx root webapp
+COPY --chown=$NGINX_USER:$NGINX_USER build /usr/share/nginx/html
 
+# Copy nginx configuration
+RUN rm etc/nginx/conf.d/default.conf
+COPY --chown=$NGINX_USER:$NGINX_USER nginx.conf etc/nginx/conf.d/
 
-COPY entrypoint.sh /entrypoint.sh
+# Add entrypoint
+COPY --chown=$NGINX_USER:$NGINX_USER entrypoint.sh /entrypoint.sh
 RUN chmod 755 /entrypoint.sh
 ENTRYPOINT [ "/entrypoint.sh" ]
 

diff --git a/nginx.conf b/nginx.conf
@@ -1,5 +1,5 @@
 server {
-    listen 80 default_server;
+    listen 8080 default_server;
     server_name /usr/share/nginx/html;
 
     root /usr/share/nginx/html;

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "stromae",
-  "version": "2.4.18",
+  "version": "2.4.19",
   "description": "Web application for the management of questionnaires powered by Lunatic",
   "repository": {
     "type": "git",