docker: user fgc instead of root

[vogler]

Fixes #468.

This works when running with a fresh volume:

But fails for existing volumes which have /fgc/data owned by root:

I guess one could give people a docker run command to fix permissions, but not sure if it's worth the headache.

Notes:

• https://www.perplexity.ai/search/what-are-the-security-implicat-rnKzzmcGShKTm.nEaAT0tQ#0
• https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• https://www.docker.com/blog/understanding-the-docker-user-instruction/
• https://www.perplexity.ai/search/how-can-i-fix-permissions-in-a-6Zy_uhnqQ6Gny2SSXy7.uQ#0
  • would require people to change permissions for their existing fgc volume? keep root, chown in entrypoint, and later change default user?
  • when you mount a volume on a directory it inherits the ownership of that directory?
  • when using docker volumes, the created volume will be preseeded with the permissions from the image when you first connect it?

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ BASH	bash-exec	1		0	0	0.01s
✅ BASH	shellcheck	1		0	0	0.06s
✅ BASH	shfmt	1	0	0	0	0.01s
⚠️ COPYPASTE	jscpd	yes		8	no	2.72s
⚠️ DOCKERFILE	hadolint	1		4	0	0.51s
⚠️ JAVASCRIPT	eslint	15	0	1	0	0.75s
✅ JSON	jsonlint	7		0	0	0.2s
✅ JSON	npm-package-json-lint	yes		no	no	0.46s
✅ JSON	prettier	7	0	0	0	0.56s
✅ JSON	v8r	7		0	0	8.86s
✅ MARKDOWN	markdownlint	2	0	0	0	0.94s
✅ MARKDOWN	markdown-table-formatter	2	0	0	0	0.3s
⚠️ REPOSITORY	checkov	yes		2	no	15.79s
✅ REPOSITORY	gitleaks	yes		no	no	0.32s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	21.15s
⚠️ REPOSITORY	kics	yes		25	no	2.6s
✅ REPOSITORY	secretlint	yes		no	no	0.81s
✅ REPOSITORY	syft	yes		no	no	1.05s
✅ REPOSITORY	trivy	yes		no	no	4.82s
✅ REPOSITORY	trufflehog	yes		no	no	3.33s
⚠️ SPELL	cspell	38		247	0	12.18s
⚠️ SPELL	lychee	17		11	0	3.0s
✅ YAML	prettier	8	0	0	0	0.73s
✅ YAML	v8r	8		0	0	7.53s
✅ YAML	yamllint	8		0	0	0.57s

See detailed report in MegaLinter reports

[sonarqubecloud]

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarQube Cloud