Use non-root user and group in default for Docker images.

Signed-off-by: Tomoya Fujita <Tomoya.Fujita@sony.com>

Author: fujitatomoya

README.md

@@ -39,7 +39,7 @@ https://github.com/fujitatomoya/ros2ai/assets/43395114/78a0799b-40e3-4dc8-99cb-4
 see available images for [tomoyafujita/ros2ai@dockerhub](https://hub.docker.com/repository/docker/tomoyafujita/ros2ai/tags?page=1&ordering=last_updated)
 
 ```bash
-docker run -it --rm --net=host -e OPENAI_API_KEY=$OPENAI_API_KEY tomoyafujita/ros2ai:humble
+docker run -it --rm --net=host -e OPENAI_API_KEY=$OPENAI_API_KEY -e OPENAI_ENDPOINT=$OPENAI_ENDPOINT -e OPENAI_MODEL_NAME=$OPENAI_MODEL_NAME tomoyafujita/ros2ai:humble
 ```
 
 > [!NOTE]

docker/Dockerfile

@@ -1,15 +1,21 @@
 # Build:
-#  docker build --rm -f ./docker/Dockerfile --build-arg="ROS_DISTRO=rolling" --build-arg="COLCON_WS=/root/colcon_ws" -t <user_name>/ros2ai:rolling .
+#  docker build --rm -f ./docker/Dockerfile --build-arg="ROS_DISTRO=rolling" --build-arg="COLCON_WS=/home/ros2ai/colcon_ws" -t <user_name>/ros2ai:rolling .
 #
 # Usage:
 #  docker pull <user_name>/ros2ai:rolling
+#
+# Note: The container runs as non-root user 'ros2ai' (UID=1000, GID=1000) by default for security.
+#       You can override the user at runtime with: docker run --user $(id -u):$(id -g) ...
 
 # An ARG declared before a FROM is outside of a build stage,
-# so it can’t be used in any instruction after a FROM.
+# so it can't be used in any instruction after a FROM.
 # To use the default value of an ARG declared before the first FROM
 # use an ARG instruction without a value inside of a build stage:
 ARG ROS_DISTRO=rolling
-ARG COLCON_WS=/root/colcon_ws
+ARG COLCON_WS=/home/ros2ai/colcon_ws
+ARG USERNAME=ros2ai
+ARG USER_UID=1234
+ARG USER_GID=1234
 
 FROM ros:${ROS_DISTRO}
 
@@ -19,11 +25,24 @@ LABEL description="ros2ai ${ROS_DISTRO} docker image"
 
 ARG ROS_DISTRO
 ARG COLCON_WS
+ARG USERNAME
+ARG USER_UID
+ARG USER_GID
 
 SHELL ["/bin/bash","-c"]
 
+# Create non-root user with sudo privileges
+RUN groupadd --gid ${USER_GID} ${USERNAME} \
+    && useradd --uid ${USER_UID} --gid ${USER_GID} -m ${USERNAME} \
+    && apt-get update \
+    && apt-get install -y sudo \
+    && echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/${USERNAME} \
+    && chmod 0440 /etc/sudoers.d/${USERNAME} \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN mkdir -p ${COLCON_WS}/src
 COPY . ${COLCON_WS}/src/ros2ai/
+RUN chown -R ${USER_UID}:${USER_GID} ${COLCON_WS}
 
 # All apt-get commands start with an update, then install
 # and finally, a cache cleanup to keep the image size small.
@@ -47,12 +66,17 @@ RUN if [ "$ROS_DISTRO" = "humble" ]; then \
 # Build and source colcon workspace
 RUN cd $COLCON_WS \
     && source /opt/ros/$ROS_DISTRO/setup.bash \
-    && colcon build --symlink-install --packages-select ros2ai
+    && colcon build --symlink-install --packages-select ros2ai \
+    && chown -R ${USER_UID}:${USER_GID} $COLCON_WS
 
 # Add source environment in .bashrc
-RUN echo -n -e "\n" >> /root/.bashrc
-RUN echo "### ros2ai workspace setting" >> /root/.bashrc
-RUN echo "cd $COLCON_WS && source ./install/setup.bash" >> /root/.bashrc
+RUN echo -n -e "\n" >> /home/${USERNAME}/.bashrc
+RUN echo "### ros2ai workspace setting" >> /home/${USERNAME}/.bashrc
+RUN echo "cd $COLCON_WS && source ./install/setup.bash" >> /home/${USERNAME}/.bashrc
+
+# Switch to non-root user
+USER ${USERNAME}
+WORKDIR /home/${USERNAME}
 
 # Overwrite as environmental variable so that entrypoint can rely on those
 # OPENAI_API_KEY should not be included here, that is required for the runtime

scripts/docker_release.sh

@@ -9,7 +9,7 @@
 ################
 
 DOCKERHUB_USERNAME="${DOCKERHUB_USERNAME:-tomoyafujita}"
-COLCON_WS="${COLCON_WS:-/root/colcon_ws}"
+COLCON_WS="${COLCON_WS:-/home/ros2ai/colcon_ws}"
 
 ros_distros=(
     "humble"
@@ -88,7 +88,7 @@ function verify_images() {
             -e OPENAI_ENDPOINT=$OPENAI_ENDPOINT \
             -e OPENAI_MODEL_NAME=$OPENAI_MODEL_NAME \
             $DOCKERHUB_USERNAME/ros2ai:$distro \
-            bash -c "/ros_entrypoint.sh && source /root/.bashrc && cd $COLCON_WS && source ./install/setup.bash && $COLCON_WS/src/ros2ai/scripts/verification.sh"
+            bash -c "/ros_entrypoint.sh && source /home/ros2ai/.bashrc && cd $COLCON_WS && source ./install/setup.bash && $COLCON_WS/src/ros2ai/scripts/verification.sh"
     done
     echo "----- all images successfully verified!!! -----"
 }