build: containers will now run as the non-root rafiki user

[bosbaber]

Changes proposed in this pull request

• Modified both the dev and prod Dockerfiles of all the services to run as the non-root Rafiki user.
• To achieve this we have to chown the packages back to rafiki after each copy to ensure the ownership is correct. Otherwise the build process create the symlinks it wants to make.

Context

As part of me trying to get into understanding the build pipeline, I noticed that the docker containers currently run as the root user which can be considered a security issue.

• For dev builds we have to switch between Rafiki and root user during the build process to ensure everything links correctly
• For prod builds, only the run-container will now run as Rafiki user, but with read-only access to the packages folder

Just to make it clear, after the change this is the status:

$ docker exec rafiki-happy-life-backend-1 touch /etc/danger-zone
touch: /etc/danger-zone: Permission denied
$ docker exec rafiki-happy-life-backend-1 whoami
rafiki

Checklist

• Related issues linked using fixes #number
• Tests added/updated
• Make sure that all checks pass
• Bruno collection updated (if necessary)
• Documentation issue created with user-docs label (if necessary)
• OpenAPI specs updated (if necessary)

[netlify]

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	b584a7e
🔍 Latest deploy log	https://app.netlify.com/sites/brilliant-pasca-3e80ec/deploys/67a9b5730b7d1700089583d0

[golobitch]

Adding also @mkurapov as a reviewer. But to me, this looks like the correct approach. However I would say that you need to create rafiki user only in the runtime container, not in any before.

[bosbaber]

Adding also @mkurapov as a reviewer. But to me, this looks like the correct approach. However I would say that you need to create rafiki user only in the runtime container, not in any before.

Good point, I made this change. Note that I am now also making the packages folder read-only for the run-container.

There are some flaky tests floating around which meant I had to manually re-run the auth tests in the pipeline. I'm sure this is a topic we will discuss soon.