[FEAT] Don't run HAProxy as root

[broizter]

Is this a new feature request?

• I have searched the existing issues

Wanted change

Run the HAProxy process as an unprivileged user. I might be missing something but I don't see any reason why it is running as root.

Reason for change

Makes the container slightly more secure.

Proposed code change

No response

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

HAProxy needs to run as root* in order to interact with the docker socket

*More specifically it needs to run as an account with permissions to interact with the docker socket, and any account that does have permissions to interact with the docker socket is functionally root.

No matter how many layers you abstract, at some point something needs to interact with the socket and that thing is functionally root on your host machine. Unless you're running docker rootless, of course, but at that point your container isn't running as root anyway.

[broizter]

HAProxy needs to run as root* in order to interact with the docker socket

*More specifically it needs to run as an account with permissions to interact with the docker socket, and any account that does have permissions to interact with the docker socket is functionally root.

No matter how many layers you abstract, at some point something needs to interact with the socket and that thing is functionally root on your host machine. Unless you're running docker rootless, of course, but at that point your container isn't running as root anyway.

That makes perfect sense. Closing!