Use deterministic UID/GID in Dockerfile #1555

Signed-off-by: tdruez <[email protected]>

Author: tdruez

Dockerfile

@@ -26,19 +26,23 @@ LABEL org.opencontainers.image.source="https://github.com/aboutcode-org/scancode
 LABEL org.opencontainers.image.description="ScanCode.io"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 
-ENV APP_NAME scancodeio
-ENV APP_USER app
-ENV APP_UID=1000
-ENV APP_GID=1000
-ENV APP_DIR /opt/$APP_NAME
-ENV VENV_LOCATION /opt/$APP_NAME/.venv
+# Set default values for APP_UID and APP_GID at build-time
+ARG APP_UID=1000
+ARG APP_GID=1000
+
+ENV APP_NAME=scancodeio
+ENV APP_USER=app
+ENV APP_UID=${APP_UID}
+ENV APP_GID=${APP_GID}
+ENV APP_DIR=/opt/$APP_NAME
+ENV VENV_LOCATION=/opt/$APP_NAME/.venv
 
 # Force Python unbuffered stdout and stderr (they are flushed to terminal immediately)
-ENV PYTHONUNBUFFERED 1
+ENV PYTHONUNBUFFERED=1
 # Do not write Python .pyc files
-ENV PYTHONDONTWRITEBYTECODE 1
+ENV PYTHONDONTWRITEBYTECODE=1
 # Add the app dir in the Python path for entry points availability
-ENV PYTHONPATH $PYTHONPATH:$APP_DIR
+ENV PYTHONPATH=$PYTHONPATH:$APP_DIR
 
 # OS requirements as per
 # https://scancode-toolkit.readthedocs.io/en/latest/getting-started/install.html
@@ -66,27 +70,24 @@ RUN apt-get update \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# Create the APP_USER group and user with specific UID and GID
-RUN groupadd --gid $APP_GID $APP_USER \
- && useradd --uid $APP_UID --gid $APP_GID --home-dir $APP_DIR --create-home $APP_USER \
- && chown $APP_USER:$APP_USER $APP_DIR
-
-# Create the /var/APP_NAME directory with proper permission for APP_USER
-RUN mkdir -p /var/$APP_NAME \
+# Create the APP_USER group, user, and directory with specific UID and GID
+RUN groupadd --gid $APP_GID --system $APP_USER \
+ && useradd --uid $APP_UID --gid $APP_GID --home-dir $APP_DIR --system --create-home $APP_USER \
+ && chown $APP_USER:$APP_USER $APP_DIR \
+ && mkdir -p /var/$APP_NAME \
  && chown $APP_USER:$APP_USER /var/$APP_NAME
 
 # Setup the work directory and the user as APP_USER for the remaining stages
 WORKDIR $APP_DIR
 USER $APP_USER
 
+# Create static/ and workspace/ directories
+RUN mkdir -p /var/$APP_NAME/static/ /var/$APP_NAME/workspace/
+
 # Create the virtualenv
 RUN python -m venv $VENV_LOCATION
 # Enable the virtualenv, similar effect as "source activate"
-ENV PATH $VENV_LOCATION/bin:$PATH
-
-# Create static/ and workspace/ directories
-RUN mkdir -p /var/$APP_NAME/static/ \
- && mkdir -p /var/$APP_NAME/workspace/
+ENV PATH=$VENV_LOCATION/bin:$PATH
 
 # Install the dependencies before the codebase COPY for proper Docker layer caching
 COPY --chown=$APP_USER:$APP_USER pyproject.toml $APP_DIR/