chore(master): run the master as nobody in the example stack (#25)

deploy/master.stack.yml

@@ -12,12 +12,16 @@
 #      The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
 #   5. Optional, for registry polling of private images: put a config.json written by
 #      `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config and
-#      uncomment DOCKER_CONFIG and the volumes entry below. The directory must exist on every
+#      uncomment DOCKER_CONFIG and the volumes entry below. The master runs as 65534:65534, so
+#      config.json must be readable by that user: `chmod 0644` it, or set `user:` below to the
+#      file owner's uid:gid. The directory must exist on every
 #      manager node (the master is placed on a manager), or Swarm rejects the task. Without
 #      it registries are accessed anonymously.
 services:
   master:
     image: gitea.shcizo.se/shcizo/package-updater:latest
+    # Runs as nobody: the master needs no root (the agent does, for the Docker socket).
+    user: "65534:65534"
     entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) UPDATER_API_KEY=$$(cat /run/secrets/pu_updater_api_key) exec /usr/local/bin/updater-master"]
     environment:
       PUBLIC_URL: https://updater.example.com