diff --git a/.changes/next-release/other-3000a7752c41a4776f985fed358751406c3f5f29.json b/.changes/next-release/other-3000a7752c41a4776f985fed358751406c3f5f29.json new file mode 100644 index 00000000000..58ab56e5bb2 --- /dev/null +++ b/.changes/next-release/other-3000a7752c41a4776f985fed358751406c3f5f29.json @@ -0,0 +1,7 @@ +{ + "type": "other", + "description": "Run container as non-root user", + "pull_requests": [ + "[#2934](https://github.com/smithy-lang/smithy/pull/2934)" + ] +} diff --git a/Dockerfile b/Dockerfile index c31beab9205..4992f070a5a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,4 +42,10 @@ RUN echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen RUN echo "LANG=en_US.UTF-8" > /etc/locale.conf ENV JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8 -ENTRYPOINT [ "/smithy/bin/smithy" ] +# Add a non-root user and set permissions +RUN useradd -m smithy && \ + chown -R smithy:smithy /smithy + +USER smithy + +ENTRYPOINT [ "/smithy/bin/smithy" ] \ No newline at end of file