Use non-root user in docker container (#382)

0xERR0R · Dec 23, 2021 · 1fd7ddd · 1fd7ddd
1 parent d7bf373
commit 1fd7ddd
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/Dockerfile b/Dockerfile
@@ -29,11 +29,14 @@ LABEL org.opencontainers.image.source="https://github.com/0xERR0R/blocky" \
       org.opencontainers.image.url="https://github.com/0xERR0R/blocky" \
       org.opencontainers.image.title="DNS proxy as ad-blocker for local network"
 
-RUN apk add --no-cache ca-certificates bind-tools tini tzdata
 COPY --from=build-env /src/bin/blocky /app/blocky
+RUN apk add --no-cache ca-certificates bind-tools tini tzdata libcap && \
+    adduser -S -D -H -h /app -s /sbin/nologin blocky && \
+    setcap 'cap_net_bind_service=+ep' /app/blocky
 
 HEALTHCHECK --interval=1m --timeout=3s CMD dig @127.0.0.1 -p 53 healthcheck.blocky +tcp +short || exit 1
 
+USER blocky
 WORKDIR /app
 
 ENTRYPOINT ["/sbin/tini", "--"]