Container nonroot

docker/Dockerfile

@@ -53,7 +53,8 @@ RUN set -eux; \
     #  create taiga group and user to use it and give permissions over the code (in entrypoint)
     groupadd --system taiga --gid=999; \
     useradd --system --no-create-home --gid taiga --uid=999 --shell=/bin/bash taiga; \
-    chown -R taiga:taiga /taiga-protected; \
+    chown -R taiga:0 /taiga-protected; \
+    chmod -R g+rwX /taiga-protected; \
     # remove unneeded files and packages
     apt-get purge -y \
        build-essential \

docker/entrypoint.sh

@@ -8,22 +8,29 @@
 
 set -euo pipefail
 
+cmd=(gunicorn server:app \
+        --name taiga_protected \
+        --bind 0.0.0.0:8003 \
+        --workers 4 \
+        --worker-tmp-dir /dev/shm \
+        --max-requests 3600 \
+        --max-requests-jitter 360 \
+        --timeout 60 \
+        --log-level=info \
+        --access-logfile - \
+        "$@" )
 
-# Give permission to taiga:taiga after mounting volumes
-echo Give permission to taiga:taiga
-chown -R taiga:taiga /taiga-protected
 
-# Start Taiga processes
-echo Starting Taiga Protected
+if [ "$(id -u)" -eq 0 ]; then
+    # Give permission to taiga:taiga after mounting volumes
+    echo Give permission to taiga:taiga
+    chown -R taiga:taiga /taiga-protected
 
-exec gosu taiga gunicorn server:app \
-    --name taiga_protected \
-    --bind 0.0.0.0:8003 \
-    --workers 4 \
-    --worker-tmp-dir /dev/shm \
-    --max-requests 3600 \
-    --max-requests-jitter 360 \
-    --timeout 60 \
-    --log-level=info \
-    --access-logfile - \
-    "$@"
+    # Start Taiga processes
+    echo Starting Taiga Protected
+    exec gosu taiga "${cmd[@]}"
+else
+    # Start Taiga processes
+    echo Starting Taiga Protected
+    exec "${cmd[@]}"
+fi