build(docker): run container as non-root, drop dead module download

Andrew Dunnrequested to merge
harden/docker-nonroot into main

What

Two container-build hygiene changes. No Go code changes; the binary is unchanged.

Run as non-root (uid 65534)

The runtime image ran as root (no USER). It now runs as USER 65534:65534, the nobody/nobody account that the ubi9/ubi-minimal base already defines in /etc/passwd and /etc/group, so it resolves to a named user with no extra useradd. The manifold process never needs root to collect, analyze, render, or serve.

WORKDIR is set to /workspace, owned by 65534. That covers two runtime modes:

  • Direct podman run / docker run (container-commands.md): WORKDIR is kept, so the relative default output dirs (data/, analysis/, public/) are created by 65534 under /workspace. For bind-mounted output dirs, the host dir must be writable by uid 65534; documented in docs/container-commands.md.
  • GitLab CI job image (deploy.yml): the runner overrides WORKDIR to $CI_PROJECT_DIR and makes that build dir writable by the job user. manifold's writes are relative os.MkdirAll("data"|"analysis"|"public") calls under that dir, so the collect -> analyze -> render -> pages chain still works. No deploy.yml change needed.

Drop dead go mod download

go.mod has no require block (pure standard library, no go.sum), so RUN go mod download fetched nothing. Removed it and the now-pointless COPY go.mod go.sum* that fed it.

Proof

Built the image with podman and ran it unprivileged:

  • id inside the container: uid=65534(nobody) gid=65534(nobody).
  • manifold version runs as nobody and prints the build-arg version.
  • Full collect -> analyze -> render chain (using generate for synthetic input) writing to bind-mounted dirs as nobody: 200 users generated, scored, and rendered to index.html + _headers + assets/ + data/.
  • Relative-path MkdirAll/write inside /workspace as nobody (the deploy.yml mechanism) succeeds.
  • Build log confirms go mod download is gone.

Go validation (binary unchanged): go vet clean, go test -race pass, coverage 69.9% (floor 65%), golangci-lint run 0 issues.

Merge request reports