expose port use uid

srinandan · Jul 6, 2020 · 8b295e3 · 8b295e3
1 parent 14cbaff
commit 8b295e3
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/google-auth-sidecar/Dockerfile b/google-auth-sidecar/Dockerfile
@@ -15,14 +15,13 @@
 #docker build -t gcr.io/srinandans-apigee/google-auth-sidecar .
 #docker run -d -p 8080:8080 --name google-auth-sidecar -v ~/sa.json:/sa.json -e GOOGLE_APPLICATION_CREDENTIALS="./sa.json" -e DEBUG="true" gcr.io/srinandans-apigee/google-auth-sidecar
 FROM golang:latest as builder
-RUN groupadd -g 2000 app && useradd -m -u 2001 -g app app
 ADD . /go/src/google-auth-sidecar 
 WORKDIR /go/src/google-auth-sidecar
 COPY . /go/src/google-auth-sidecar
+RUN groupadd -r -g 20000 app && useradd -M -u 20001 -g 0 -r -c "Default app user" app && chown -R 20001:0 /go
 ENV GO111MODULE=on
 RUN go mod download
-RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags '-w -extldflags "-static"' -o /go/bin/google-auth-sidecar
-RUN chown -R app:0 /go
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath  -a -ldflags '-s -w -extldflags "-static"' -o /go/bin/google-auth-sidecar
 
 #without these certificates, we cannot verify the JWT token
 FROM alpine:latest as certs
@@ -33,5 +32,6 @@ WORKDIR /
 COPY --from=builder /go/bin/google-auth-sidecar .
 COPY --from=builder /etc/passwd /etc/group /etc/shadow /etc/
 COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-USER app
+USER 20001
+EXPOSE 8080
 CMD ["./google-auth-sidecar"]