Dockerfile: Use podman user, not root

Dockerfile

@@ -1,74 +1,58 @@
 FROM quay.io/podman/stable:latest
+
 EXPOSE 5000
 
+ENV USERNAME="podman"
+ENV HOME_DIR="/home/$USERNAME"
+ENV BIN_DIR="$HOME_DIR/.local/bin"
+ENV UV_INSTALL_DIR="$HOME_DIR/.local"
+ENV PATH="$PATH:$BIN_DIR"
+ENV DATA_DIR="$HOME_DIR/data"
+ENV APP_DIR="$HOME_DIR/github-webhook-server"
+
 RUN dnf -y install dnf-plugins-core \
-  && dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo \
   && dnf -y update \
-  && dnf -y install python3.8 \
-  python3.9 \
-  python3.10 \
-  python3.11 \
-  python3.12 \
-  python3-pip \
+  && dnf -y install \
   git \
   hub \
   unzip \
-  libcurl-devel \
   gcc \
   python3-devel \
-  libffi-devel \
-  docker-ce \
-  docker-ce-cli \
-  containerd.io \
-  docker-buildx-plugin \
-  docker-compose-plugin \
   && dnf clean all \
   && rm -rf /var/cache /var/log/dnf* /var/log/yum.*
 
-ENV USER_BIN_DIR="/root/.local/bin"
-ENV UV_INSTALL_DIR="/root/.local"
-ENV PATH="$PATH:$USER_BIN_DIR"
 
-ENV DATA_DIR=/webhook_server
-ENV APP_DIR=/github-webhook-server
-
-RUN mkdir -p $USER_BIN_DIR \
+RUN mkdir -p $BIN_DIR \
+  && mkdir -p $APP_DIR \
   && mkdir -p $DATA_DIR \
   && mkdir -p $DATA_DIR/logs \
   && mkdir -p /tmp/containers
 
+COPY entrypoint.sh pyproject.toml uv.lock README.md $APP_DIR/
+COPY webhook_server_container $APP_DIR/webhook_server_container/
+
+RUN usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USERNAME \
+  && chown -R $USERNAME:$USERNAME $HOME_DIR
+
+USER $USERNAME
+WORKDIR $HOME_DIR
+
 # Download the latest uv installer
 RUN curl -sSL https://astral.sh/uv/install.sh -o /tmp/uv-installer.sh \
   && sh /tmp/uv-installer.sh \
   && rm /tmp/uv-installer.sh
 
 RUN set -x \
-  && curl https://mirror.openshift.com/pub/openshift-v4/clients/rosa/latest/rosa-linux.tar.gz --output /tmp/rosa-linux.tar.gz \
-  && tar xvf /tmp/rosa-linux.tar.gz --no-same-owner \
-  && mv rosa $USER_BIN_DIR/rosa \
-  && chmod +x $USER_BIN_DIR/rosa \
-  && rm -rf /tmp/rosa-linux.tar.gz
-
-RUN ln -s /usr/bin/python3 /usr/bin/python
-
-RUN python -m pip install --no-cache-dir pip --upgrade \
-  && python -m pip install --no-cache-dir poetry tox twine pre-commit
-
-RUN python3.8 -m ensurepip \
-  && python3.9 -m ensurepip \
-  && python3.10 -m ensurepip \
-  && python3.11 -m ensurepip \
-  && python3.12 -m ensurepip \
-  && python3.8 -m pip install tox \
-  && python3.9 -m pip install tox \
-  && python3.10 -m pip install tox \
-  && python3.11 -m pip install tox \
-  && python3.12 -m pip install tox
-
-COPY entrypoint.sh pyproject.toml uv.lock README.md $APP_DIR/
-COPY webhook_server_container $APP_DIR/webhook_server_container/
+  && curl https://mirror.openshift.com/pub/openshift-v4/clients/rosa/latest/rosa-linux.tar.gz --output $BIN_DIR/rosa-linux.tar.gz \
+  && tar xvf $BIN_DIR/rosa-linux.tar.gz \
+  && mv rosa $BIN_DIR/rosa \
+  && chmod +x $BIN_DIR/rosa \
+  && rm -rf $BIN_DIR/rosa-linux.tar.gz
 
 WORKDIR $APP_DIR
 
+RUN uv sync
+
 HEALTHCHECK CMD curl --fail http://127.0.0.1:5000/webhook_server/healthcheck || exit 1
+
 ENTRYPOINT ["./entrypoint.sh"]

docker-compose-example.yaml

@@ -3,8 +3,7 @@ services:
     container_name: github-webhook-server
     build: quay.io/myakove/github-webhook-server
     volumes:
-      - "./webhook_server_data_dir:/webhook_server:Z" # Should include config.yaml and webhook-server.private-key.pem
-      - "./webhook_server_containers:/containers:Z" # Optional, to cache podman pull containers
+      - "./webhook_server_data_dir:/home/podman/data:Z" # Should include config.yaml and webhook-server.private-key.pem
     environment:
       - PUID=1000
       - PGID=1000

webhook_server_container/app.py

@@ -10,16 +10,16 @@
 from webhook_server_container.utils.helpers import get_logger_with_params
 
 FASTAPI_APP: FastAPI = FastAPI(title="webhook-server")
-APP_ROOT_PATH: str = "/webhook_server"
+APP_URL_ROOT_PATH: str = "/webhook_server"
 urllib3.disable_warnings()
 
 
-@FASTAPI_APP.get(f"{APP_ROOT_PATH}/healthcheck")
+@FASTAPI_APP.get(f"{APP_URL_ROOT_PATH}/healthcheck")
 def healthcheck() -> Dict[str, Any]:
     return {"status": requests.codes.ok, "message": "Alive"}
 
 
-@FASTAPI_APP.post(APP_ROOT_PATH)
+@FASTAPI_APP.post(APP_URL_ROOT_PATH)
 async def process_webhook(request: Request) -> Dict[str, Any]:
     logger_name: str = "main"
     logger = get_logger_with_params(name=logger_name)

webhook_server_container/libs/config.py

@@ -6,7 +6,7 @@
 
 class Config:
     def __init__(self) -> None:
-        self.data_dir: str = os.environ.get("WEBHOOK_SERVER_DATA_DIR", "/webhook_server")
+        self.data_dir: str = os.environ.get("WEBHOOK_SERVER_DATA_DIR", "/home/podman/data")
         self.config_path: str = os.path.join(self.data_dir, "config.yaml")
         self.exists()