Run as non-root user

.dockerignore

@@ -0,0 +1,6 @@
+# Ignore everything
+*
+
+# Allow specific files and folders
+!/requirements.txt
+!/cloudflare-ddns.py

.vscode/settings.json

@@ -8,6 +8,7 @@
     "**/Thumbs.db": true,
     ".github": true,
     ".gitignore": true,
+    ".dockerignore": true,
     ".vscode": true,
     "Dockerfile": true,
     "LICENSE": true,

Dockerfile

@@ -1,18 +1,22 @@
 # ---- Base ----
 FROM python:alpine AS base
 
+ENV VENV_DIR="/app"
+ENV PATH="${VENV_DIR}/bin:$PATH"
+
 #
 # ---- Dependencies ----
 FROM base AS dependencies
 # install dependencies
 COPY requirements.txt .
-RUN pip install --user -r requirements.txt
+RUN python3 -m venv "${VENV_DIR}"
+RUN pip install -r requirements.txt
 
 #
 # ---- Release ----
 FROM base AS release
 # copy installed dependencies and project source file(s)
 WORKDIR /
-COPY --from=dependencies /root/.local /root/.local
+COPY --from=dependencies "${VENV_DIR}" "${VENV_DIR}"
 COPY cloudflare-ddns.py .
 CMD ["python", "-u", "/cloudflare-ddns.py", "--repeat"]

README.md

@@ -291,9 +291,7 @@ services:
     security_opt:
       - no-new-privileges:true
     network_mode: 'host'
-    environment:
-      - PUID=1000
-      - PGID=1000
+    user: 1000:1000
     volumes:
       - /YOUR/PATH/HERE/config.json:/config.json
     restart: unless-stopped

docker/docker-compose.yml

@@ -1,14 +1,11 @@
-version: '3.9'
 services:
   cloudflare-ddns:
     image: timothyjmiller/cloudflare-ddns:latest
     container_name: cloudflare-ddns
     security_opt:
       - no-new-privileges:true
     network_mode: 'host'
-    environment:
-      - PUID=1000
-      - PGID=1000
+    user: 1000:1000
     volumes:
       - /YOUR/PATH/HERE/config.json:/config.json
     restart: unless-stopped