[DOP-25348] Change image user to non-root

Author: dolfinus

docker/Dockerfile.scheduler

@@ -14,7 +14,8 @@ ENTRYPOINT ["/app/entrypoint.sh"]
 
 FROM base AS builder
 
-RUN pip install poetry
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install poetry
 
 COPY ./pyproject.toml ./poetry.lock ./
 RUN --mount=type=cache,target=/root/.cache/pypoetry \
@@ -34,6 +35,11 @@ COPY --from=builder /app/.venv/ /app/.venv/
 COPY ./syncmaster/ /app/syncmaster/
 RUN python -m compileall -b syncmaster
 
+# Do not run production as root, to improve security.
+# Also user does not own anything inside the image, including venv and source code.
+RUN useradd syncmaster
+USER syncmaster
+
 
 FROM builder AS test
 

docker/Dockerfile.server

@@ -36,7 +36,8 @@ ENTRYPOINT ["/app/entrypoint.sh"]
 
 FROM base AS builder
 
-RUN pip install poetry
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install poetry
 
 COPY ./pyproject.toml ./poetry.lock* ./
 RUN --mount=type=cache,target=/root/.cache/pypoetry \
@@ -54,6 +55,11 @@ COPY --from=builder /app/.venv/ /app/.venv/
 COPY ./syncmaster/ /app/syncmaster/
 RUN python -m compileall -b syncmaster
 
+# Do not run production as root, to improve security.
+# Also user does not own anything inside the image, including venv and source code.
+RUN useradd syncmaster
+USER syncmaster
+
 
 FROM builder AS test
 

docker/Dockerfile.worker

@@ -29,7 +29,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         libkrb5-dev \
     && rm -rf /var/lib/apt/lists/* /var/cache/*
 
-RUN pip install poetry
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install poetry
 
 COPY ./pyproject.toml ./poetry.lock ./
 RUN --mount=type=cache,target=/root/.cache/pypoetry \
@@ -47,6 +48,11 @@ COPY --from=builder /app/.venv/ /app/.venv/
 COPY ./syncmaster/ /app/syncmaster/
 RUN python -m compileall syncmaster
 
+# Do not run production as root, to improve security.
+# Also user does not own anything inside the image, including venv and source code.
+RUN useradd syncmaster
+USER syncmaster
+
 
 FROM builder AS test