From bdda82ad3f77caafcab83c5d0c326b56e221cbea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BA=91=E5=8E=9F=E7=94=9F=E6=9E=81=E5=BA=A6=E5=8F=91?=
 =?UTF-8?q?=E7=83=A7=E5=8F=8B?=
 <16606960+hurricane1988@users.noreply.github.com>
Date: Wed, 6 Aug 2025 20:01:20 +0800
Subject: [PATCH] Configure the Dockerfile to run the application as a non-root
 user. (#202)

<!-- Provide a brief summary of your changes -->
run the application as a non-root user.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
run the application as a non-root user.

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
YES, build the docker image.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] New feature (non-breaking change which adds functionality)


## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Co-authored-by: hurricane1988 <niujianping_qm@dayu.work>
Co-authored-by: adam jones <domdomegg+git@gmail.com>
---
 Dockerfile | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index dd828a4..11dde41 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,6 +9,20 @@ WORKDIR /app
 COPY --from=builder /build/registry .
 COPY --from=builder /app/data/seed.json /app/data/seed.json
 COPY --from=builder /app/internal/docs/swagger.yaml /app/internal/docs/swagger.yaml
+
+# Create a non-privileged user that the app will run under.
+# See https://docs.docker.com/go/dockerfile-user-best-practices/
+ARG UID=10001
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    appuser
+
+USER appuser
 EXPOSE 8080
 
 ENTRYPOINT ["./registry"]