run-as-non-root-user-good-dockerfile

run-as-non-root-user-good.Dockerfile

# GOOD

FROM python:3.9.1-slim as app

WORKDIR /myapp/

# Creates `appuser` and `appgroup` and sets permissions on the app`s directory
RUN addgroup appgroup --gid 1000 && \
    useradd appuser --uid 1000 --gid appgroup --home-dir /myapp/ && \
    chown -R appuser:appgroup /myapp/

# All the following commands will be executed by `appuser`, instead of `root`
USER appuser

# Copy artifacts from the build stage and set `appuser` as the owner
COPY --from=build --chown=appuser:appgroup /myapp/

ENTRYPOINT ["app"]