Following the current docker-compose instructions from https://hub.docker.com/r/athou/commafeed, the server will be running as the root user. That's a security issue, and we should always avoid running processes as root.
It should run as its own user. Bonus points for having the UID/GID configurable.
Configurable UID:GID is needed if the person is mounting /commafeed/data as a volume, because it will match the permissions for that path. (By the way, this should be in the basic configuration example.)
Screenshots
$ docker compose top
commafeed-commafeed-1
UID PID PPID C STIME TTY TIME CMD
root 637880 637860 9 08:53 ? 00:00:22 java -jar commafeed.jar server config.yml
Environment (please complete the following information):
CommaFeed version (or "commafeed.com"): latest
Browser [e.g. chrome, firefox]: N/A
Device [e.g. desktop, mobile]: N/A
Additional context
You could consider following the structure of the many other images from LinuxServer.IO. Those images always run as a configurable normal user and even have a configurable timezone.
If you go through that route, you can contribute your image to their project. Not only it will be easy to setup for most people, but also gives some exposure as something linked from and supported by LSIO.
Describe the bug
Following the current docker-compose instructions from https://hub.docker.com/r/athou/commafeed, the server will be running as the
rootuser. That's a security issue, and we should always avoid running processes as root.To Reproduce
Steps to reproduce the behavior:
docker-compose.ymlfile following the instructions from https://hub.docker.com/r/athou/commafeed.docker compose up -dhtop, search forcommafeed; ordocker compose topExpected behavior
It should run as its own user. Bonus points for having the UID/GID configurable.
Configurable UID:GID is needed if the person is mounting
/commafeed/dataas a volume, because it will match the permissions for that path. (By the way, this should be in the basic configuration example.)Screenshots
Environment (please complete the following information):
latestAdditional context
You could consider following the structure of the many other images from LinuxServer.IO. Those images always run as a configurable normal user and even have a configurable timezone.
If you go through that route, you can contribute your image to their project. Not only it will be easy to setup for most people, but also gives some exposure as something linked from and supported by LSIO.