Dockerfile updates

- Also uses OpenContainer annotations as in our product images
- Switches to a different user id for security reasons

Author: lfrancke

template/docker/Dockerfile.j2

@@ -9,23 +9,78 @@ FROM registry.access.redhat.com/ubi9/ubi-minimal AS operator
 ARG VERSION
 ARG RELEASE="1"
 
-LABEL name="Stackable Operator for {[ operator.pretty_string }]" \
-  maintainer="[email protected]" \
-  vendor="Stackable GmbH" \
-  version="${VERSION}" \
-  release="${RELEASE}" \
-  summary="Deploy and manage {[ operator.pretty_string }] clusters." \
-  description="Deploy and manage {[ operator.pretty_string }] clusters."
+# These are chosen at random and are this high on purpose to have very little chance to clash with an existing user or group on the host system
+ARG STACKABLE_USER_GID="574654813"
+ARG STACKABLE_USER_UID="782252253"
+
+# These labels have mostly been superseded by the OpenContainer spec annotations below but it doesn't hurt to include them
+# http://label-schema.org/rc1/
+LABEL name="Stackable Operator for {[ operator.pretty_string }]"
+LABEL maintainer="[email protected]"
+LABEL vendor="Stackable GmbH"
+LABEL version="${VERSION}"
+LABEL release="${RELEASE}"
+LABEL summary="Deploy and manage {[ operator.pretty_string }] clusters."
+LABEL description="Deploy and manage {[ operator.pretty_string }] clusters."
+
+# Overwriting/Pinning UBI labels
+# https://github.com/projectatomic/ContainerApplicationGenericLabels
+LABEL vcs-ref=""
+LABEL distribution-scope="public"
+LABEL url="https://stackable.tech"
+ARG TARGETARCH
+LABEL architecture="${TARGETARCH}"
+LABEL com.redhat.component=""
+# It complains about it being an invalid label but RedHat uses it and we want to override it and it works....
+# hadolint ignore=DL3048
+LABEL com.redhat.license_terms=""
+LABEL io.buildah.version=""
+LABEL io.openshift.expose-services=""
+
+# https://github.com/opencontainers/image-spec/blob/036563a4a268d7c08b51a08f05a02a0fe74c7268/annotations.md#annotations
+LABEL org.opencontainers.image.authors="[email protected]"
+LABEL org.opencontainers.image.url="https://stackable.tech"
+LABEL org.opencontainers.image.vendor="Stackable GmbH"
+LABEL org.opencontainers.image.licenses="OSL-3.0"
+LABEL org.opencontainers.image.documentation="https://docs.stackable.tech/home/stable/{{ operator.product_string }}/"
+LABEL org.opencontainers.image.version="${VERSION}"
+LABEL org.opencontainers.image.revision="${RELEASE}"
+LABEL org.opencontainers.image.title="Stackable Operator for {[ operator.pretty_string }]"
+LABEL org.opencontainers.image.description="Deploy and manage {[ operator.pretty_string }] clusters."
+
+# https://docs.openshift.com/container-platform/4.16/openshift_images/create-images.html#defining-image-metadata
+# https://github.com/projectatomic/ContainerApplicationGenericLabels/blob/master/vendor/redhat/labels.md
+LABEL io.openshift.tags="ubi9,stackable,sdp,{{ operator.product_string }}"
+LABEL io.k8s.description="Deploy and manage {[ operator.pretty_string }] clusters."
+LABEL io.k8s.display-name="Stackable Operator for {[ operator.pretty_string }]"
 
 # Update image and install kerberos client libraries
-# install_weak_deps in microdnf does not support the literal "False" as dnf does
-# https://github.com/rpm-software-management/microdnf/blob/a600c62f29262d71a6259b70dc220df65a2ab9b5/dnf/dnf-main.c#L176-L189
-RUN microdnf update -y --setopt=install_weak_deps=0 \
-    && microdnf install -y --setopt=install_weak_deps=0 \
-      krb5-libs \
-      libkadm5 \
-    && microdnf clean all \
-    && rm -rf /var/cache/yum
+RUN <<EOF
+microdnf update
+microdnf install -y \
+  krb5-libs \
+  libkadm5 \
+  shadow-utils
+
+groupadd --gid ${STACKABLE_USER_GID} --system ${STACKABLE_USER_NAME}
+# The --no-log-init is required to work around a bug/problem in Go/Docker when very large UIDs are used
+# See https://github.com/moby/moby/issues/5419#issuecomment-41478290 for more context
+# Making this a system user prevents a mail dir from being created, expiry of passwords etc. but it will warn:
+#   useradd warning: stackable's uid 1000 is greater than SYS_UID_MAX 999
+# We can safely ignore this warning, to get rid of the warning we could change /etc/login.defs but that does not seem worth it
+# We'll leave the home directory hardcoded to /stackable because I don't want to deal with which chars might be valid and which might not in user name vs. directory
+useradd \
+  --no-log-init \
+  --gid ${STACKABLE_USER_GID} \
+  --uid ${STACKABLE_USER_UID} \
+  --system \
+  --create-home \
+  --home-dir /stackable \
+   stackable
+microdnf remove shadow-utils
+microdnf clean all
+rm -rf /var/cache/yum
+EOF
 
 COPY LICENSE /licenses/LICENSE
 
@@ -34,9 +89,7 @@ COPY --from=builder /app/* /usr/local/bin/
 COPY deploy/config-spec/properties.yaml /etc/stackable/{[ operator.name }]/config-spec/properties.yaml
 {[% endif %}]
 
-RUN groupadd -g 1000 stackable && adduser -u 1000 -g stackable -c 'Stackable Operator' stackable
-
-USER stackable:stackable
+USER ${STACKABLE_USER_UID}
 
 ENTRYPOINT ["stackable-{[ operator.name }]"]
 CMD ["run"]