Rootless (#659)

* WIP: rootless run container

* Use hadolint for Dockerfile linting

* Add support for signing via cosign

* Add pub key

Author: Mark Phelps

.gitignore

@@ -34,3 +34,4 @@ tmp
 __debug_bin
 
 Brewfile.lock.json
+*.key

.goreleaser.yml

@@ -57,3 +57,8 @@ dockers:
     extra_files:
       - config/migrations/
       - config/default.yml
+
+docker_signs:
+  - artifacts: all
+    stdin: "{{ .Env.COSIGN_PWD }}"
+    output: true

Brewfile

@@ -1,12 +1,14 @@
-tap 'filosottile/musl-cross'
 tap 'bufbuild/buf'
+tap 'filosottile/musl-cross'
 tap 'goreleaser/tap'
 
-brew 'go'
+brew 'buf'
 brew 'cmake'
+brew 'cosign'
+brew 'go'
+brew 'goreleaser'
+brew 'hadolint'
+brew 'musl-cross'
 brew 'pkg-config'
-brew 'sqlite'
 brew 'protobuf'
-brew 'musl-cross'
-brew 'goreleaser'
-brew 'buf'
+brew 'sqlite'

Dockerfile

@@ -8,16 +8,21 @@ RUN apt-get update && \
     gnupg \ 
     sudo \
     openssh-server \
-    postgresql-client
+    postgresql-client && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - && \
     echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
 
 RUN curl -sL https://deb.nodesource.com/setup_16.x | bash
 
 RUN apt-get update && \
-    apt-get install -y nodejs yarn && \
-    apt-get clean -y
+    apt-get install -y --no-install-recommends \
+    nodejs \
+    yarn && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /flipt
 

build/Dockerfile

@@ -18,7 +18,13 @@ COPY $BINARY /
 COPY config/migrations/ /etc/flipt/config/migrations/
 COPY config/*.yml /etc/flipt/config/
 
+RUN addgroup flipt && \
+    adduser -S -D -H -g '' -G flipt -s /bin/sh flipt && \
+    chown -R flipt:flipt /etc/flipt /var/opt/flipt
+
 EXPOSE 8080
 EXPOSE 9000
 
+USER flipt
+
 CMD ["./flipt"]

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpgwkLrS1BAPoXVjnKoq5Nj2U93I0
+eYi0jMMhh/DbaNk2LBF6rdj9c3bcDGIGjcU3EtcrPoHfSk+YM2+V4P5Vbw==
+-----END PUBLIC KEY-----