Add non-root user to container image

Dockerfile

@@ -21,13 +21,25 @@ RUN go install \
     -ldflags="-X main.gitDescribe=$(git -C /go/src/github.com/ROCm/k8s-device-plugin/ describe --always --long --dirty)"
 
 FROM alpine:3.20.3
+
+ARG USERNAME=amdgpu
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
 LABEL \
     org.opencontainers.image.source="https://github.com/ROCm/k8s-device-plugin" \
     org.opencontainers.image.authors="Kenny Ho <[email protected]>" \
     org.opencontainers.image.vendor="Advanced Micro Devices, Inc." \
     org.opencontainers.image.licenses="Apache-2.0"
+
 RUN apk --no-cache add ca-certificates libdrm
 RUN apk --no-cache add hwloc --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
-WORKDIR /root/
+
+RUN addgroup --gid "$USER_GID" "$USERNAME" \
+    && adduser --disabled-password --gecos "" --uid "$USER_UID" --ingroup "$USERNAME" "$USERNAME"
+
+USER $USERNAME
+
+WORKDIR /home/$USERNAME/
 COPY --from=0 /go/bin/k8s-device-plugin .
 CMD ["./k8s-device-plugin", "-logtostderr=true", "-stderrthreshold=INFO", "-v=5"]

labeller.Dockerfile

@@ -20,12 +20,23 @@ RUN go install \
     -ldflags="-X main.gitDescribe=$(git -C /go/src/github.com/ROCm/k8s-device-plugin/ describe --always --long --dirty)"
 
 FROM alpine:3.20.3
+
+ARG USERNAME=amdgpu
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
 LABEL \
     org.opencontainers.image.source="https://github.com/ROCm/k8s-device-plugin" \
     org.opencontainers.image.authors="Kenny Ho <[email protected]>" \
     org.opencontainers.image.vendor="Advanced Micro Devices, Inc." \
     org.opencontainers.image.licenses="Apache-2.0"
 RUN apk --no-cache add ca-certificates libdrm
-WORKDIR /root/
+
+RUN addgroup --gid "$USER_GID" "$USERNAME" \
+    && adduser --disabled-password --gecos "" --uid "$USER_UID" --ingroup "$USERNAME" "$USERNAME"
+
+USER $USERNAME
+
+WORKDIR /home/$USERNAME/
 COPY --from=0 /go/bin/k8s-node-labeller .
 CMD ["./k8s-node-labeller"]