Merge pull request #500 from vastsa/fix/docker-run-as-root

fix: run Docker as root for volume compatibility

Author: vastsa

Dockerfile

@@ -63,14 +63,7 @@ RUN apt-get update \
  && apt-get upgrade -y --no-install-recommends \
  && rm -rf /var/lib/apt/lists/* \
  && pip install --no-cache-dir -r requirements.txt \
- && pip cache purge || true \
- && groupadd --system --gid 1000 appuser \
- && useradd --system --uid 1000 --gid appuser --create-home --home-dir /home/appuser --shell /usr/sbin/nologin appuser \
- && mkdir -p /app/data \
- && chown -R appuser:appuser /app
-
-# 非 root 运行，降低容器逃逸后的主机影响面
-USER appuser
+ && pip cache purge || true
 
 # 环境变量配置
 ENV HOST="0.0.0.0" \

docker-compose.yml

@@ -2,7 +2,6 @@ version: "3"
 services:
   file-code-box:
     image: lanol/filecodebox:2.5.3 # x-release-please-version
-    user: "1000:1000"
     volumes:
       - fcb-data:/app/data:rw
     restart: unless-stopped

tests/test_security_gaps.py

@@ -90,13 +90,13 @@ def test_successful_login_does_not_consume_failure_quota(self):
         self.assertTrue(ip_limit["login"].check_ip("198.51.100.8"))
 
 
-class DockerNonRootTests(unittest.TestCase):
-    def test_dockerfile_runs_as_non_root_user(self):
+class DockerRuntimeUserTests(unittest.TestCase):
+    def test_dockerfile_defaults_to_root_for_volume_compatibility(self):
+        # 默认 root：兼容已有 data 卷权限；如需非 root 可由编排层自行指定 user
         text = Path("Dockerfile").read_text()
-        self.assertIn("USER appuser", text)
-        self.assertIn("--uid 1000", text)
+        self.assertNotIn("USER appuser", text)
         compose = Path("docker-compose.yml").read_text()
-        self.assertIn('user: "1000:1000"', compose)
+        self.assertNotIn('user: "1000:1000"', compose)
 
 
 if __name__ == "__main__":