chore(master): run the master as a non-root user (#25) (#27)

deploy/master.stack.yml

@@ -12,12 +12,17 @@
 #      The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
 #   5. Optional, for registry polling of private images: put a config.json written by
 #      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config and
-#      uncomment DOCKER_CONFIG and the volumes entry below. The directory must exist on every
-#      manager node (the master is placed on a manager), or Swarm rejects the task. Without
-#      it registries are accessed anonymously.
+#      uncomment DOCKER_CONFIG and the volumes entry below. The master runs as 65534:65534, so
+#      the directory and config.json must be readable by that user while staying private:
+#      `chown -R 65534:65534 /path/to/docker-config` (keep 0700/0600), or set `user:` below
+#      to the owner's uid:gid. Do not make config.json world-readable; it holds registry
+#      passwords. The directory must exist on every manager node (the master is placed on a
+#      manager), or Swarm rejects the task. Without it registries are accessed anonymously.
 services:
   master:
     image: gitea.shcizo.se/shcizo/package-updater:latest
+    # Runs as nobody: the master needs no root (the agent does, for the Docker socket).
+    user: "65534:65534"
     entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) UPDATER_API_KEY=$$(cat /run/secrets/pu_updater_api_key) exec /usr/local/bin/updater-master"]
     environment:
       PUBLIC_URL: https://updater.example.com