Remove apt repository list and custom scripts from Dockerfiles

Author: jgaucher-cs

services/adgs/.github/Dockerfile

@@ -45,15 +45,18 @@ RUN opentelemetry-bootstrap -a install && layer-cleanup.sh
 RUN apt autoremove -y git && layer-cleanup.sh
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 ENTRYPOINT [ \
     "python", "-m", "uvicorn", "rs_server_adgs.fastapi.adgs_app:app", \

services/cadip/.github/Dockerfile

@@ -45,15 +45,18 @@ RUN opentelemetry-bootstrap -a install && layer-cleanup.sh
 RUN apt autoremove -y git && layer-cleanup.sh
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 ENTRYPOINT [ \
     "python", "-m", "uvicorn", "rs_server_cadip.fastapi.cadip_app:app", \

services/catalog/.github/Dockerfile

@@ -45,17 +45,20 @@ RUN opentelemetry-bootstrap -a install && layer-cleanup.sh
 RUN apt autoremove -y git && layer-cleanup.sh
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
 # [DEBUG_MODE_RELOAD_CATALOG]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 # See: rs_server_catalog/main.py
 # uvicorn.run(

services/frontend/.github/Dockerfile

@@ -60,15 +60,18 @@ RUN chmod ugo+x /scripts/entrypoint_frontend.sh
 RUN chmod -R ugo+w $(dirname "${RSPY_OPENAPI_FILE}")
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 ENTRYPOINT [ "/bin/bash", "-c", "set -x; /scripts/entrypoint_frontend.sh [DEBUG_MODE_RELOAD_FRONTEND]" ]
 

services/prip/.github/Dockerfile

@@ -45,15 +45,18 @@ RUN opentelemetry-bootstrap -a install && layer-cleanup.sh
 RUN apt autoremove -y git && layer-cleanup.sh
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 ENTRYPOINT [ \
     "python", "-m", "uvicorn", "rs_server_prip.fastapi.prip_app:app", \

services/staging/.github/Dockerfile

@@ -57,15 +57,18 @@ COPY --from=builder /usr/local /usr/local
 RUN opentelemetry-bootstrap -a install && layer-cleanup.sh
 
 # Add a default user
-RUN useradd -m user
-USER user
-WORKDIR /home/user
+ARG USER=user
+RUN useradd -m $USER
+USER $USER
+WORKDIR /home/$USER
 
 # The CI/CD will replace this tag in debug mode or else remove it
 # [DEBUG_MODE_COMMANDS]
 
-# After this, make sure we're still non-root
-USER user
+# Remove apt repository list and custom scripts
+USER root
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+USER $USER
 
 ENTRYPOINT [ \
     "python", "-m", "uvicorn", "rs_server_staging.main:app", \

services/staging/.github/Dockerfile.dask-staging-local

@@ -55,6 +55,9 @@ RUN apt autoremove -y gcc git && layer-cleanup.sh
 # Install dependencies necessary for execution not compilation
 RUN restore-apt.sh && apt install -y libexpat1 && layer-cleanup.sh
 
+# Remove apt repository list and custom scripts
+RUN rm -f /etc/apt/sources.list /usr/local/bin/layer-cleanup.sh /usr/local/bin/restore-apt.sh
+
 USER $USER
 
 # Set labels based on the Open Containers Initiative (OCI):