(tooling-trusted-releases) branch sbp updated: Run the Alpine container as the ATR user instead of root

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new ae4cb279 Run the Alpine container as the ATR user instead of root
ae4cb279 is described below

commit ae4cb2792e4555e49de41e81b6c061bf27759e6a
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Fri Jul 17 16:33:04 2026 +0100

    Run the Alpine container as the ATR user instead of root
---
 .github/workflows/build.yml | 2 ++
 Dockerfile.alpine           | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56113ba7..7f2fb21c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -129,6 +129,8 @@ jobs:
             docker volume rm -f "$NRVOL" >/dev/null 2>&1 || true
           }
           trap cleanup EXIT
+          test "$(docker image inspect atr:ci --format '{{.Config.User}}')" = "1000:1000"
+          test "$(docker run --rm atr:ci id -u)" = "1000"
           docker volume create "$NRVOL"
           docker run --rm --user 0:0 -v "$NRVOL:/opt/atr/state" atr:ci chown 1000:1000 /opt/atr/state
           docker run -d --name "$NRSRV" --user 1000:1000 \
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 5a7e58a2..150e70d4 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -142,4 +142,6 @@ EXPOSE 8080
 
 WORKDIR /opt/atr
 
+USER 1000:1000
+
 CMD ["./start-atr.sh"]


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org