Merge pull request #135 from microsoftgraph/fix/docker_capabilities

Run docker image as root

Author: calebkiage

.dockerignore

@@ -7,4 +7,5 @@
 **/*.sample.*
 tmp/
 **/.env
-**/*.md
+**/*.md
+docker-compose.yml

Dockerfile

@@ -28,23 +28,21 @@ RUN apk add --no-cache libsecret dbus gnome-keyring libcap &&\
     dbus-uuidgen > /var/lib/dbus/machine-id &&\
     setcap cap_ipc_lock=+ep $(which gnome-keyring-daemon)
 
-RUN addgroup mgc &&\
-    adduser -D -G mgc -h /app mgc
+# TODO: Find work-around for running image as a non-root user.
+# Docker doesn't support adding capabilities to non-root users. See https://training.play-with-docker.com/security-capabilities/
 
 WORKDIR /app
 
 COPY --from=build-env /app/output ./dist
 
 RUN ln -s /app/dist/mgc /usr/bin/mgc
 
-USER mgc
+COPY ./docker/* ./dist/
 
-COPY --chown=mgc:mgc ./docker/* ./dist/
-
-RUN mkdir -p /app/.mgc /app/.local/share/.IdentityService /app/.local/share/keyrings &&\
+RUN mkdir -p /root/.mgc /root/.local/share/.IdentityService /root/.local/share/keyrings &&\
     chmod +x /app/dist/init.sh
 
-VOLUME [ "/app/.mgc", "/app/.local/share/.IdentityService", "/app/.local/share/keyrings" ]
+VOLUME [ "/root/.mgc", "/root/.local/share/.IdentityService", "/root/.local/share/keyrings" ]
 
 ENTRYPOINT ["./dist/init.sh"]
 

docker-compose.yml

@@ -9,6 +9,6 @@ services:
     environment:
       - KEYRING_PASSWORD=changeit
     volumes:
-      - ./tmp/.mgc:/app/.mgc
-      - ./tmp/.IdentityService:/app/.local/share/.IdentityService
-      - ./tmp/keyrings:/app/.local/share/keyrings
+      - ./tmp/.mgc:/root/.mgc
+      - ./tmp/.IdentityService:/root/.local/share/.IdentityService
+      - ./tmp/keyrings:/root/.local/share/keyrings