Use containers as non root users

docker-compose.yml

@@ -15,7 +15,13 @@ services:
       - lila-network
 
   lila:
-    image: sbtscala/scala-sbt:eclipse-temurin-alpine-21.0.2_13_1.10.0_3.4.2
+    build:
+      context: docker
+      args:
+        USER_ID: ${USER_ID}
+        GROUP_ID: ${GROUP_ID}
+      dockerfile: sbt.Dockerfile
+    user: ${USER_ID}:${GROUP_ID}
     working_dir: /lila
     entrypoint: ./lila run
     restart: unless-stopped
@@ -187,6 +193,7 @@ services:
       context: docker
       dockerfile: ui.Dockerfile
     restart: unless-stopped
+    user: ${USER_ID}:${GROUP_ID}
     networks:
       - lila-network
     volumes:

docker/sbt.Dockerfile

@@ -0,0 +1,11 @@
+FROM sbtscala/scala-sbt:eclipse-temurin-alpine-21.0.2_13_1.10.0_3.4.2
+
+ARG USER_ID
+ARG GROUP_ID
+
+RUN if ! id -u $USER_ID > /dev/null 2>&1; then \
+        adduser -D -u $USER_ID -G $(id -gn sbtuser) -h $(eval echo ~sbtuser) newuser && \
+        chown -R newuser:$(id -gn sbtuser) $(eval echo ~sbtuser); \
+    fi
+
+CMD ["sbt"]

lila-docker

@@ -1,6 +1,9 @@
 #!/bin/bash -e
 
 run_setup() {
+    echo "USER_ID=$(id -u)" > .env
+    echo "GROUP_ID=$(id -g)" >> .env
+
     rust_cmd setup
 
     docker compose build
@@ -40,6 +43,9 @@ all_profiles() {
 }
 
 build_all_profiles() {
+    echo "USER_ID=$(id -u)" > .env
+    echo "GROUP_ID=$(id -g)" >> .env
+
     COMPOSE_PROFILES=$(all_profiles) docker compose pull
     COMPOSE_PROFILES=$(all_profiles) docker compose build
 }