docker image: switch to a new non-root user when started as root

docker/Dockerfile

@@ -12,24 +12,22 @@ RUN apt-get update && apt-get install -y \
   samba \
   telnet \
   texlive-base \
-  texinfo
-
-# RUN git config --global http.sslVerify false
-# RUN cd /tmp && git clone https://github.com/arichardson/bmake && cd bmake \
-#  && ./configure --with-default-sys-path=/usr/local/share/mk --with-machine=amd64 --without-meta --without-filemon --prefix=/usr/local \
-#  && sh ./make-bootstrap.sh && make install && rm -rf /tmp/bmake
+  texinfo \
+  libtool pkg-config autotools-dev automake autoconf \
+  libarchive-dev libglib2.0-dev libpixman-1-dev \
+  bison groff-base flex \
+  cmake \
+  clang-12 lld-12 \
+  gosu && \
+  apt-get clean
 
 COPY cheribuild.json /root/.config/cheribuild.json
-
-# deps to build QEMU+elftoolchain:
-RUN apt-get update && apt-get install -y \
-  libtool pkg-config autotools-dev automake autoconf libglib2.0-dev libpixman-1-dev \
-  bison groff-base libarchive-dev flex
-
-RUN apt-get update && apt-get install -y cmake
-
-RUN apt-get install -y clang-12 lld-12
+COPY entrypoint.sh /usr/bin/entrypoint.sh
 
 VOLUME ["/cheribuild", "/source", "/build", "/output"]
 ENV PATH /cheribuild:$PATH
-CMD bash
+# We use an ENTRYPOINT script to ensure that cheribuild is run as a non-root
+# user that has a UID/GID matching the host so that file ownership in the
+# volumes
+ENTRYPOINT ["/usr/bin/entrypoint.sh"]
+CMD ["/bin/bash"]

docker/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh -e
+
+if [ "$(id -u)" != 0 ]; then
+    # echo "Already running as non-root, can't change user."
+    exec "$@"
+fi
+# Create a non-root user with UID/GID matching the host user to ensure that
+# files written to the volumes are not owned by root.
+: "${cheribuild_uid:=1234}"
+: "${cheribuild_gid:=1234}"
+: "${cheribuild_user:=cheri}"
+addgroup --quiet --gid ${cheribuild_gid} "${cheribuild_user}"
+useradd --uid "${cheribuild_uid}" --gid "${cheribuild_gid}" --create-home --no-user-group --password '*' "${cheribuild_user}"
+
+# Copy the cheribuild configuration to the unprivileged user's home directory:
+export HOME="/home/${cheribuild_user}"
+mkdir "${HOME}/.config"
+cp -f /root/.config/cheribuild.json "${HOME}/.config/cheribuild.json"
+chown -R "${cheribuild_uid}:${cheribuild_gid}" "${HOME}/.config"
+# Run the actual command:
+exec gosu "${cheribuild_user}" "$@"