Update default_nonroot_user.df (#141)

src/docker/_imports/default_nonroot_user.df

@@ -1,8 +1,6 @@
-FROM main as ext
 
-RUN  addgroup --gid 1000 hugo \
-    && adduser --uid 1000 --gid 1000 --disabled-password --gecos "" hugo \
+# Create a custom user with UID 1234 and GID 1234
+RUN getent group hugo 2>&1 > /dev/null || groupadd -g 1234 hugo && \
+    getent passwd hugo 2>&1 > /dev/null || useradd -m -u 1234 -g hugo hugo \
     && chown -R hugo /src \
     && chown -R hugo /target
-
-USER hugo

src/docker/_imports/default_nonroot_user_alpine.df

@@ -0,0 +1,4 @@
+RUN  getent group hugo 2>&1 > /dev/null || addgroup -g 1234 hugo \
+    &&  getent passwd hugo 2>&1 > /dev/null || adduser -u 1234 -D -H -G hugo -g "" hugo \
+    && chown -R hugo /src \
+    && chown -R hugo /target

src/docker/alpine-ext/ext-alpine.df

@@ -22,6 +22,8 @@ ENV HUGO_BIND="0.0.0.0" \
     GOROOT="/usr/local/lib/go" \
     HOME="/tmp"
 
+USER root
+
 RUN apk -U upgrade && apk add --no-cache libc6-compat gcompat libstdc++ openssl ncurses-libs busybox-suid bash bash-completion git tzdata make \
     # Python 3
     python3 py3-pip py3-setuptools
@@ -51,8 +53,12 @@ RUN true \
 
 EXPOSE 1313
 
+IMPORT ../_imports/default_nonroot_user_alpine.df
+
 WORKDIR /src
 
+USER hugo
+
 ENTRYPOINT ["hugo"]
 
 
@@ -62,5 +68,6 @@ IMPORT ../_imports/ci.df
 IMPORT ../_imports/onbuild.df
 
 
-
 FROM main
+
+USER hugo

src/docker/alpine-ext/ext-asciidoctor.df

@@ -1,15 +1,17 @@
 FROM ext-alpine AS main
 
+USER root
+
 RUN apk -U upgrade && apk --no-cache add asciidoctor \
  && gem install coderay --no-document \
  && find /tmp -mindepth 1 -maxdepth 1 | xargs rm -rf
 
-
+IMPORT ../_imports/default_nonroot_user_alpine.df
 
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
+FROM main
 
-
-FROM main
+USER hugo

src/docker/alpine-ext/ext-pandoc.df

@@ -2,12 +2,12 @@ FROM ext-alpine AS main
 
 COPY --from=base--pandoc / /
 
-
+IMPORT ../_imports/default_nonroot_user_alpine.df
 
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
+FROM main
 
-
-FROM main
+USER hugo

src/docker/alpine/alpine.df

@@ -16,24 +16,20 @@ ENV HUGO_BIND="0.0.0.0" \
     HOME="/tmp"
 
 COPY --from=image / /
-
+USER root
 RUN apk -U upgrade && apk --no-cache add busybox-suid bash bash-completion tzdata make \
  && find /tmp -mindepth 1 -maxdepth 1 | xargs rm -rf \
  && mkdir -p /src /target \
  && chmod a+w /src /target
 
 EXPOSE 1313
-
+IMPORT ../_imports/default_nonroot_user_alpine.df
 WORKDIR /src
-
 ENTRYPOINT ["hugo"]
 
-
-
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
-
-
-FROM main
+FROM main
+USER hugo

src/docker/alpine/asciidoctor.df

@@ -1,15 +1,15 @@
 FROM alpine AS main
-
+USER root
 RUN apk -U upgrade && apk --no-cache add asciidoctor \
  && gem install coderay asciidoctor-rouge --no-document \
  && find /tmp -mindepth 1 -maxdepth 1 | xargs rm -rf
 
-
+IMPORT ../_imports/default_nonroot_user_alpine.df
 
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
+FROM main
 
-
-FROM main
+USER hugo

src/docker/alpine/pandoc.df

@@ -4,12 +4,12 @@ ENV HUGO_PANDOC="pandoc-default"
 
 COPY --from=base--pandoc / /
 
-
+IMPORT ../_imports/default_nonroot_user_alpine.df
 
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
+FROM main
 
-
-FROM main
+USER hugo

src/docker/debian-ext/Dockerfile

@@ -18,6 +18,8 @@ ENV HUGO_EDITION="extended" \
 
 COPY --from=image / /
 
+USER root
+
 RUN true \
  #
  # Install software
@@ -64,6 +66,8 @@ IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
-
+IMPORT ../_imports/default_nonroot_user.df
 
 FROM main
+
+USER hugo

src/docker/debian/base.df

@@ -6,7 +6,7 @@ ENV HUGO_BIND="0.0.0.0" \
     HUGO_DESTINATION="public" \
     HUGO_ENV="DEV" \
     HOME="/tmp"
-
+USER root
 RUN apt update \
  && apt full-upgrade -y \
  && DEBIAN_FRONTEND=noninteractive apt install -y wget bash-completion tzdata make ca-certificates \
@@ -18,7 +18,7 @@ RUN apt update \
 COPY --from=base--files--debian / /
 
 EXPOSE 1313
-
+IMPORT ../_imports/default_nonroot_user.df
 WORKDIR /src
-
+USER hugo
 ENTRYPOINT ["hugo"]

src/docker/debian/debian.df

@@ -4,12 +4,12 @@ ENV HUGO_EDITION="standard"
 
 COPY --from=base--hugo--standard / /
 
-
-
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
+IMPORT ../_imports/default_nonroot_user.df
 
+FROM main
 
-FROM main
+USER hugo

src/docker/ubuntu-ext/Dockerfile

@@ -18,6 +18,8 @@ ENV HUGO_EDITION="extended" \
 
 COPY --from=image / /
 
+USER root
+
 RUN true \
  #
  # Install software
@@ -58,12 +60,12 @@ RUN true \
 
 COPY --from=base--golang / /
 
-
-
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
 IMPORT ../_imports/default_nonroot_user.df
 
 FROM main
+
+USER hugo

src/docker/ubuntu/base.df

@@ -9,6 +9,8 @@ ENV HUGO_BIND="0.0.0.0" \
 
 COPY --from=base--files--ubuntu / /
 
+USER root
+
 RUN apt update \
  && apt -y full-upgrade \
  && DEBIAN_FRONTEND=noninteractive apt install -y wget bash-completion tzdata make ca-certificates \
@@ -18,7 +20,9 @@ RUN apt update \
  && chmod a+w /src /target 
 
 EXPOSE 1313
-
+IMPORT ../_imports/default_nonroot_user.df
 WORKDIR /src
 
+USER hugo
+
 ENTRYPOINT ["hugo"]

src/docker/ubuntu/ubuntu.df

@@ -4,12 +4,12 @@ ENV HUGO_EDITION="standard"
 
 COPY --from=base--hugo--standard / /
 
-
-
 IMPORT ../_imports/ci.df
 
 IMPORT ../_imports/onbuild.df
 
 IMPORT ../_imports/default_nonroot_user.df
 
-FROM main
+FROM main
+
+USER hugo