Enhancement: Update Docker images to run as non-root user

[georgemccabe]

Our images are currently configured to run as root. It is recommended to define a default non-root user for running the containers. This is a best practice to prevent users from modifying the software. The user can be overridden on the command line using the --user argument as needed. Note: Apptainer uses the calling user as the user inside the container, so this does not affect the use of our images with Apptainer.

Describe the Enhancement

Update the Dockerfile(s) to define a new user and switch to that user after all of the software/tools has been installed as root. Create a working area where the user will have permissions to write.

RUN groupadd -r metplus && useradd -r -g metplus -u 1000 metplus
USER metplus
WORKDIR /work

We should also replace any commands that set env vars like PATH in the /root/.bashrc file to using ENV so that it is available for all users who run the container. This is a current limitation using Apptainer where the METplus run script is not in the path because it is not run by root.

Similar changes should be made to the Dockerfiles found in the MET and METviewer repositories.

Time Estimate

~1 day

Sub-Issues

Consider breaking the enhancement down into sub-issues.

• Add a checkbox for each sub-issue here.

Relevant Deadlines

7.0.0

Funding Source

AF

Define the Metadata

Assignee

• Select engineer(s) or no engineer required
• Select scientist(s) or no scientist required

Labels

• Review default alert labels
• Select component(s)
• Select priority
• Select requestor(s)

Milestone and Projects

• Select Milestone as a METplus-Wrappers-X.Y.Z version, Consider for Next Release, or Backlog of Development Ideas
• For a METplus-Wrappers-X.Y.Z version, select the METplus-Wrappers-X.Y.Z Development project

Define Related Issue(s)

Consider the impact to the other METplus components.

• METplus, MET, METdataio, METviewer, METexpress, METcalcpy, METplotpy

Enhancement Checklist

See the METplus Workflow for details.

• Complete the issue definition above, including the Time Estimate and Funding Source.
• Fork this repository or create a branch of develop.
  Branch name: feature_<Issue Number>_<Description>
• Complete the development and test your changes.
• Add/update log messages for easier debugging.
• Add/update unit tests.
• Add/update documentation.
• Add any new Python packages to the METplus Components Python Requirements table.
• For any new datasets, an entry to the METplus Verification Datasets Guide.
• Push local changes to GitHub.
• Submit a pull request to merge into develop.
  Pull request: feature <Issue Number> <Description>
• Define the pull request metadata, as permissions allow.
  Select: Reviewer(s) and Development issue
  Select: Milestone as the next official version
  Select: METplus-Wrappers-X.Y.Z Development project for development toward the next official release
• Iterate until the reviewer(s) accept and merge your changes.
• Delete your fork or branch.
• Close this issue.