chore(master): run the master as a non-root user (#25) (#27)

README.md

@@ -28,14 +28,16 @@ a time per service, and one job at a time per agent.
 Use [`deploy/master.stack.yml`](deploy/master.stack.yml) as a starting point (Swarm stack;
 needs Postgres and an OIDC provider). The master listens for the UI on `PORT` (default
 `8080`, put it behind your reverse proxy) and for agents on `AGENT_PORT` (default `8090`,
-pinned TLS, reached directly on the internal network).
+pinned TLS, reached directly on the internal network). The example runs the master as
+`nobody` (`65534`); it needs no root. The agent runs as root because access to the Docker
+socket is root on the host anyway.
 
 | Variable | Required | Default | Purpose |
 |---|---|---|---|
 | `UPDATER_API_KEY` | no | — | Bearer token for `POST /update`. Without it the webhook answers `503` and the master logs `webhook_disabled`. |
 | `UPDATE_TIMEOUT` | no | `5m` | How long one `POST /update` waits for its auto jobs (Go duration). |
 | `POLL_INTERVAL` | no | `6h` | Time between registry polling cycles (Go duration, must be positive). The first cycle runs one minute after start. |
-| `DOCKER_CONFIG` | no | `~/.docker` | Directory with a `config.json` holding registry credentials for polling. Only inline `auths` entries work; see [Registry polling](#registry-polling). |
+| `DOCKER_CONFIG` | no | `~/.docker` | Directory with a `config.json` holding registry credentials for polling, readable by the master's user. Only inline `auths` entries work; see [Registry polling](#registry-polling). |
 
 The master's other settings (`DATABASE_URL`, `PUBLIC_URL`, `AGENT_URL`, `OIDC_*`,
 `ALLOWED_GROUP`, `AGENT_IMAGE`, `PORT`, `AGENT_PORT`, `LOG_LEVEL`) are shown in
@@ -146,11 +148,14 @@ multi-arch image the digest is the index digest, the same one `docker inspect` s
   tags continue. A later success clears it.
 - **Credentials.** The master reads `$DOCKER_CONFIG/config.json` (a file written by
   `docker login`), mounted read-only into the container; without it registries are accessed
-  anonymously. Only inline `auths` entries are supported. A `credsStore` or `credHelpers`
+  anonymously. The directory and file must be readable by the master's user (`65534` in the
+  example stack) without being world-readable: `chown -R 65534:65534` the directory and keep
+  `0700`/`0600`. Only inline `auths` entries are supported. A `credsStore` or `credHelpers`
   entry makes every lookup fail with `error getting credentials ... executable file not found
   in $PATH`, because the container has no credential helper binaries. The master logs
-  `registry_credentials` at startup with the directory and whether `config.json` exists,
-  never its contents.
+  `registry_credentials` at startup with the directory, `config_json_found` and
+  `config_json_readable`, never the contents. If the file exists but cannot be opened it also
+  logs a `registry_credentials_unreadable` warning with the error.
 - **Requests go wherever the image name points.** The master sends the lookup to the
   registry host in the image name, including a `GET /v2/` ping that follows redirects.
   Anyone who can start containers on a managed host can therefore make the master send