chore: drop root in container

Runner.Dockerfile

@@ -15,7 +15,7 @@ FROM docker.io/library/debian:bookworm-slim
 
 WORKDIR /app
 RUN    apt-get update && apt-get upgrade -y \
-    && apt-get install -y ca-certificates libnl-route-3-200 libprotobuf32 tini \
+    && apt-get install -y ca-certificates gosu libnl-route-3-200 libprotobuf32 tini \
     && apt-get clean && rm -rf /var/lib/apt/lists
 
 # rootfs
@@ -31,5 +31,8 @@ COPY --from=base /builder/config.docker.yaml /app
 COPY --from=base /builder/docker-entrypoint.sh /app
 COPY --from=base /builder/woj /app
 
+# tell entrypoint to setup runner env
+ENV RUNNER_IMAGE=1
+
 # reap zombies
 ENTRYPOINT ["/usr/bin/tini", "/app/docker-entrypoint.sh"]

Server.Dockerfile

@@ -12,7 +12,7 @@ RUN find /app -type f -name "*.map" -delete
 FROM docker.io/library/alpine
 
 WORKDIR /app
-RUN apk --no-cache add tzdata ca-certificates bash
+RUN apk --no-cache add tzdata ca-certificates bash su-exec
 
 COPY --from=base /builder/config.docker.yaml /app
 COPY --from=base /builder/docker-entrypoint.sh /app

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   server:
-    image: git.0x7f.app/woj/woj-server:1.3.1-dev
+    image: quay.io/ldcraft/woj-server:1.3.1-dev
     restart: unless-stopped
     healthcheck:
       test: [ "CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8000/health" ]
@@ -27,12 +27,11 @@ services:
       - "8000:8000"
 
   runner:
-    image: git.0x7f.app/woj/woj-runner:1.3.1-dev
+    image: quay.io/ldcraft/woj-runner:1.3.1-dev
     restart: unless-stopped
     command: runner
+    # moby/moby#42040, enable privileged option to make cgroup2 mount as rw
     privileged: true
-    cap_add:
-      - SYS_ADMIN
     environment:
       - REDIS_ADDRESS=cache
       - STORAGE_ENDPOINT=storage:9000
@@ -40,7 +39,6 @@ services:
       - STORAGE_SECRET_KEY=secret_key
       - STORAGE_BUCKET=woj
       - DEVELOPMENT=true
-      - SETUP_CGROUP=true
     volumes:
       - runner:/app/resource/runner/user
       - /etc/localtime:/etc/localtime:ro

docker-entrypoint.sh

@@ -136,11 +136,37 @@ setup_cgroups() {
     sed -e 's/ / +/g' -e 's/^/+/' < /sys/fs/cgroup/nsjail/cgroup.controllers > /sys/fs/cgroup/nsjail/cgroup.subtree_control
 }
 
-if [ -n "$SETUP_CGROUP" ]; then
-    setup_cgroups
-fi
+setup_user_runner() {
+    # runner use debian as base image
+    groupadd --gid 1000            woj || true
+    useradd  --gid 1000 --uid 1000 woj || true
+    # runner data
+    chown -R woj:woj /app/resource/runner/problem
+    chown -R woj:woj /app/resource/runner/tmp
+    chown -R woj:woj /app/resource/runner/user
+    # cgroups
+    chown -R woj:root /sys/fs/cgroup/nsjail
+}
 
+setup_user_server() {
+    # server use alpine as base image
+    addgroup -g 1000 -S    woj     || true
+    adduser  -u 1000 -S -G woj woj || true
+}
+
+setup_user() {
+    if [ -n "$RUNNER_IMAGE" ]; then
+        setup_user_runner
+    else
+        setup_user_server
+    fi
+}
+
+if [ -n "$RUNNER_IMAGE" ]; then setup_cgroups; fi
 generate_config
+setup_user
 
 log_info "starting woj"
-exec /app/woj "$@"
+if [ -n "$RUNNER_IMAGE" ]; then EXEC=gosu; else EXEC=su-exec; fi
+exec $EXEC woj /app/woj "$@"
+