Security improvement and image upgrade

[faan11]

Hi,

This is the content of the pull request:

• add root readonly filesystem
• add non-root user
• add git+ssh support
• upgrade alpine+overlay

I've tested it with my raspberry pi.

[XelaRellum]

Well, I have made some minor tweaks, namely the different architecture, then ran the build docker image:

Creating network "radicale_default" with the default driver
Creating radicale_web_1 ... done
Attaching to radicale_web_1
web_1  | s6-rc: info: service s6rc-oneshot-runner: starting
web_1  | s6-rc: info: service s6rc-oneshot-runner successfully started
web_1  | s6-rc: info: service fix-attrs: starting
web_1  | s6-rc: info: service fix-attrs successfully started
web_1  | s6-rc: info: service legacy-cont-init: starting
web_1  | cont-init: info: running /etc/cont-init.d/99-radicale
web_1  | /package/admin/s6-overlay-3.1.6.2/etc/s6-rc/scripts/cont-init: line 20: /etc/cont-init.d/99-radicale: not found
web_1  | cont-init: info: /etc/cont-init.d/99-radicale exited 127
web_1  | s6-rc: info: service legacy-cont-init successfully started
web_1  | s6-rc: info: service legacy-services: starting
web_1  | services-up: info: copying legacy longrun radicale-daemon (no readiness notification)
web_1  | s6-rc: info: service legacy-services successfully started
web_1  | s6-supervise radicale-daemon: warning: unable to spawn ./run (waiting 60 seconds): No such file or directory
^CGracefully stopping... (press Ctrl+C again to force)

So something still seems to be amiss.

[faan11]

Hi @XelaRellum

Thank you for your feedback, i forgot to fix the shabang. I've followed the documentation: https://github.com/just-containers/s6-overlay?tab=readme-ov-file#container-environment Can you check it again?

Thank you

[XelaRellum]

Hello @faan11, I have tweaked your changes a bit. We now pin the radicale version; this way we have docker tags as well, not just a rolling latest.

Thanks a lot for your effort, it is greatly valued!