Final non-root changes to Python, Ruby and C# templates

template/csharp/Dockerfile

@@ -4,31 +4,39 @@ ENV DOTNET_CLI_TELEMETRY_OPTOUT 1
 
 # Optimize for Docker builder caching by adding projects first.
 
-RUN mkdir -p /root/src/function
-WORKDIR /root/src/function
+RUN mkdir -p /home/app/src/function
+WORKDIR /home/app/src/function
 COPY ./function/Function.csproj  .
 
-WORKDIR /root/src/
+WORKDIR /home/app/src
 COPY ./root.csproj  .
+
 RUN dotnet restore ./root.csproj
 
 COPY .  .
 
 RUN dotnet publish -c release -o published
 
 FROM microsoft/dotnet:2.0-runtime
+RUN addgroup -S app && adduser -S -g app app
 
 RUN apt-get update -qy \
     && apt-get install -qy curl ca-certificates --no-install-recommends \ 
     && echo "Pulling watchdog binary from Github." \
-    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.9/fwatchdog > /usr/bin/fwatchdog \
+    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.12/fwatchdog > /usr/bin/fwatchdog \
     && chmod +x /usr/bin/fwatchdog \
     && apt-get -qy remove curl \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /root/
-COPY --from=builder /root/src/published .
+WORKDIR /home/app/
+COPY --from=builder /home/app/src/published .
+
+# chmod for tmp is for a buildkit issue (@alexellis)
+RUN chown app:app -R /home/app \
+    && chmod 777 /tmp
+
+USER app
 
 ENV fprocess="dotnet ./root.dll"
 EXPOSE 8080

template/node/Dockerfile

@@ -5,7 +5,7 @@ RUN addgroup -S app && adduser -S -g app app
 # Alternatively use ADD https:// (which will not be cached by Docker builder)
 RUN apk --no-cache add curl \
     && echo "Pulling watchdog binary from Github." \
-    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.9/fwatchdog > /usr/bin/fwatchdog \
+    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.12/fwatchdog > /usr/bin/fwatchdog \
     && chmod +x /usr/bin/fwatchdog \
     && apk del curl --no-cache
 

template/python/Dockerfile

@@ -1,27 +1,35 @@
 FROM python:2.7-alpine
 
+RUN addgroup -S app && adduser -S -g app app
+
 # Alternatively use ADD https:// (which will not be cached by Docker builder)
 RUN apk --no-cache add curl \ 
     && echo "Pulling watchdog binary from Github." \
-    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.9/fwatchdog > /usr/bin/fwatchdog \
+    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.12/fwatchdog > /usr/bin/fwatchdog \
     && chmod +x /usr/bin/fwatchdog \
     && apk del curl --no-cache
 
-WORKDIR /root/
+COPY index.py           /home/app
+COPY requirements.txt   /home/app
 
-COPY index.py           .
-COPY requirements.txt   .
+WORKDIR /home/app
 RUN pip install -r requirements.txt
 
 RUN mkdir -p function
 RUN touch ./function/__init__.py
-WORKDIR /root/function/
+WORKDIR /home/app/function/
 COPY function/requirements.txt	.
 RUN pip install -r requirements.txt
 
-WORKDIR /root/
+WORKDIR /home/app
 COPY function           function
 
+# chmod for tmp is for a buildkit issue (@alexellis)
+RUN chown app:app -R /home/app \
+    && chmod 777 /tmp
+
+USER app
+
 ENV fprocess="python index.py"
 
 HEALTHCHECK --interval=1s CMD [ -e /tmp/.lock ] || exit 1

template/python3/Dockerfile

@@ -1,13 +1,15 @@
 FROM python:3-alpine
 
+RUN addgroup -S app && adduser -S -g app app
+
 # Alternatively use ADD https:// (which will not be cached by Docker builder)
 RUN apk --no-cache add curl \ 
     && echo "Pulling watchdog binary from Github." \
-    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.9/fwatchdog > /usr/bin/fwatchdog \
+    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.12/fwatchdog > /usr/bin/fwatchdog \
     && chmod +x /usr/bin/fwatchdog \
     && apk del curl --no-cache
 
-WORKDIR /root/
+WORKDIR /home/app
 
 COPY index.py           .
 COPY requirements.txt   .
@@ -17,11 +19,18 @@ COPY function           function
 
 RUN touch ./function/__init__.py
 
-WORKDIR /root/function/
+WORKDIR /home/app/function/
+
 COPY function/requirements.txt	.
 RUN pip install -r requirements.txt
 
-WORKDIR /root/
+WORKDIR /home/app
+
+# chmod for tmp is for a buildkit issue (@alexellis)
+RUN chown app:app -R /home/app \
+    && chmod 777 /tmp
+
+USER app
 
 ENV fprocess="python3 index.py"
 

template/ruby/Dockerfile

@@ -1,23 +1,32 @@
 FROM ruby:2.4-alpine3.6
 
+RUN addgroup -S app && adduser -S -g app app
+
 # Alternatively use ADD https:// (which will not be cached by Docker builder)
 RUN apk --no-cache add curl \ 
     && echo "Pulling watchdog binary from Github." \
-    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.9/fwatchdog > /usr/bin/fwatchdog \
+    && curl -sSL https://github.com/openfaas/faas/releases/download/0.6.12/fwatchdog > /usr/bin/fwatchdog \
     && chmod +x /usr/bin/fwatchdog \
     && apk del curl --no-cache
 
-WORKDIR /root/
+WORKDIR /home/app/
 
 COPY Gemfile		.
 COPY index.rb           .
 COPY function           function
 RUN bundle install 
 
-WORKDIR /root/function/
+WORKDIR /home/app/function/
 RUN bundle install 
 
-WORKDIR /root/
+WORKDIR /home/app/
+
+# chmod for tmp is for a buildkit issue (@alexellis)
+RUN chown app:app -R /home/app \
+    && chmod 777 /tmp
+
+USER app
+
 ENV fprocess="ruby index.rb"
 HEALTHCHECK --interval=2s CMD [ -e /tmp/.lock ] || exit 1