Run ot-recorder as an unprivileged user.

- Default UID is 9999 (defined with EUID=9999) inside Dockerfile.
- Please note that the docker volume is visible as a directory on the
  host under /var/lib/docker/volumes.  This is normally not a problem,
  as this directory is not accessible by regular users on the host.
- It is still possible to redefine the UID by passing -e EUID=<uid> to
  docker run, but that should not be necessary in most situations.
  This fact has been left out of the documentation as it only appeals
  to more advanced users (who will look at the Dockerfile directly.)

Dockerfile

@@ -12,12 +12,15 @@ COPY recorder.conf /etc/default/recorder.conf
 COPY recorder-health.sh /usr/local/sbin/recorder-health.sh
 
 ENV VERSION=$recorder_version
+ENV EUID=9999
 
 RUN apk add --no-cache --virtual .build-deps \
         curl-dev libconfig-dev make \
-        gcc musl-dev mosquitto-dev wget \
+        gcc musl-dev mosquitto-dev shadow wget \
     && apk add --no-cache \
         libcurl libconfig-dev mosquitto-dev lmdb-dev libsodium-dev lua5.2-dev \
+    && groupadd -g $EUID appuser \
+    && useradd -r -u $EUID -s "/bin/sh" -g appuser appuser \
     && mkdir -p /usr/local/source \
     && cd /usr/local/source \
     && wget https://github.com/owntracks/recorder/archive/$VERSION.tar.gz \

entrypoint.sh

@@ -1,5 +1,12 @@
 #!/bin/sh
 
+# If running as root (first invocation), fix mountpoint permissions
+# and re-run this script as appuser.
+if [[ $(id -u) -eq 0 ]]; then
+  chown -R appuser:appuser /store /config
+  exec su -c "$0" appuser
+fi
+
 # Load Default recorder.conf if not available
 if [ ! -f /config/recorder.conf ]; then
 	  cp /etc/default/recorder.conf /config/recorder.conf