Non-Privileged Docker Container

[GoliathLabs]

Good day,
first of all thanks for this nice project and the work that's put into it.

I was wondering whether it would be possible change the Dockerfile so that the container doesn't run as root (as this is favoured by docker itself as best practise)?

Which parts of the project would be easy to change over to non-root and which could pose some sort of challenge?

Kind regards!

[claabs]

I'm down to convert the image to non-root.

My main concern with moving to non-root user is backwards compatibility around permissions with already generated config and cookie files. I'd have to do some testing.

[GoliathLabs]

One possibility would be to display a message in the captcha solving window that this change will happen soon and that users should be aware that they need to change permissions accordingly. Maybe there is another way to run a "two-stage" container that first only changes the permissions and then in the second stages drops the privileges and runs as user 1001 or so?