Merge pull request #237 from pantierra/non-root-container

Add non-root user for container.

Author: vincentsarago

CHANGES.md

@@ -1,9 +1,10 @@
 # Release Notes
 
-## Unreleased 
+## Unreleased
 
 * remove `cql-text` support for PgSTACSearch `filter`
 * add `filter` and `filter-lang` for CollectionIdParams dependency
+* changed container image to use non-root `user`
 
 ## 1.9.0 (2025-09-23)
 
@@ -12,7 +13,7 @@
     * add OpenTelemetry instrumentation to the tiler factory classes
     * fix layer's bounds for non-wgs84 CRS in WMTS document
     * refactor HTML templating
-    * remove python 3.9 support 
+    * remove python 3.9 support
 
 * switch from bitnami to official python:3.12 docker image
 

Dockerfile

@@ -26,11 +26,17 @@ COPY LICENSE LICENSE
 RUN python -m pip install --no-cache-dir --upgrade .["psycopg-binary"]
 RUN rm -rf titiler/ pyproject.toml README.md LICENSE
 
+RUN groupadd -g 1000 user && \
+    useradd -u 1000 -g user -s /bin/bash -m user
+
+USER user
+
 ###################################################
 # For compatibility (might be removed at one point)
 ENV MODULE_NAME=titiler.pgstac.main
 ENV VARIABLE_NAME=app
 ENV HOST=0.0.0.0
 ENV PORT=80
 ENV WEB_CONCURRENCY=1
+
 CMD gunicorn -k uvicorn.workers.UvicornWorker ${MODULE_NAME}:${VARIABLE_NAME} --bind ${HOST}:${PORT} --workers ${WEB_CONCURRENCY}