From 47e273651cd0b8bce225601dfddb04228b9fd829 Mon Sep 17 00:00:00 2001
From: Marco Paganini <paganini@paganini.net>
Date: Thu, 12 Mar 2020 22:10:37 -0700
Subject: [PATCH] Run ot-recorder as an unprivileged user.

- Default UID is 9999 (defined with EUID=9999) inside Dockerfile.
- Please note that the docker volume is visible as a directory on the
  host under /var/lib/docker/volumes.  This is normally not a problem,
  as this directory is not accessible by regular users on the host.
- It is still possible to redefine the UID by passing -e EUID=<uid> to
  docker run, but that should not be necessary in most situations.
  This fact has been left out of the documentation as it only appeals
  to more advanced users (who will look at the Dockerfile directly.)
---
 Dockerfile    | 5 ++++-
 entrypoint.sh | 7 +++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 97eb622..d248482 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,12 +12,15 @@ COPY recorder.conf /etc/default/recorder.conf
 COPY recorder-health.sh /usr/local/sbin/recorder-health.sh
 
 ENV VERSION=$recorder_version
+ENV EUID=9999
 
 RUN apk add --no-cache --virtual .build-deps \
         curl-dev libconfig-dev make \
-        gcc musl-dev mosquitto-dev wget \
+        gcc musl-dev mosquitto-dev shadow wget \
     && apk add --no-cache \
         libcurl libconfig-dev mosquitto-dev lmdb-dev libsodium-dev lua5.2-dev \
+    && groupadd -g $EUID appuser \
+    && useradd -r -u $EUID -s "/bin/sh" -g appuser appuser \
     && mkdir -p /usr/local/source \
     && cd /usr/local/source \
     && wget https://github.com/owntracks/recorder/archive/$VERSION.tar.gz \
diff --git a/entrypoint.sh b/entrypoint.sh
index 68ccc87..eec6147 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,5 +1,12 @@
 #!/bin/sh
 
+# If running as root (first invocation), fix mountpoint permissions
+# and re-run this script as appuser.
+if [[ $(id -u) -eq 0 ]]; then
+  chown -R appuser:appuser /store /config
+  exec su -c "$0" appuser
+fi
+
 # Load Default recorder.conf if not available
 if [ ! -f /config/recorder.conf ]; then
 	  cp /etc/default/recorder.conf /config/recorder.conf