user: 5000:5000 support

[jamilnielsen]

Feature description

PUID/PGID are nice and all, but user is more secure on the premise that containers are inherently not very secure, preventing a privilage escalation entirely by having the entire container be non-root helps greatly on this front.

Motivation

• i like security, and foundry is the weakest link on my server.
• future proofing

Example

compose.yml
foundry:
image: felddy/foundryvtt:release
container_name: foundryvtt
user: X:Y #could be anything
etc...

Pitch

while some people might throw around words like threat model saying these things are needless and over the top, people who use docker are likely to be running many things on their server, so securing everything that's exposed is essential.

Code of Conduct

• I agree to follow this project's Code of Conduct

[inknos]

@jamilnielsen late to the party. Did you consider running the stack with podman?

[gmillerd]

@jamilnielsen late to the party. Did you consider running the stack with podman?

it's already supported in the IMAGE, just not implemented. Why would the project require podman?

[inknos]

It seemed the concerns were about privesc. so to prevent getting root access outside of the container one could simply use podman as a replacement from docker and get the same functionality. I believe no action would be needed and it could work out of the box.

[jamilnielsen]

@jamilnielsen late to the party. Did you consider running the stack with podman?

it's already supported in the IMAGE, just not implemented. Why would the project require podman?

FoundryVTT is by far the single greatest security risk in my stack, when i asked mods for comment in discord their approach to FoundryVTT security was "turn it off when not using it", there's so many things i cannot do, like how its incompatible with even the most basic of header security.

It seemed the concerns were about privesc. so to prevent getting root access outside of the container one could simply use podman as a replacement from docker and get the same functionality. I believe no action would be needed and it could work out of the box.

in my current setup it would be difficult to use podman (truenas electric eel)
but yes, i absolutely would use podman if i could...that said foundry is inherently so insecure anyways that i(and everyone else) should absolutely house it on its own machine, that is completely isolated from the rest of the network.
currently my setup is basically Router1-PFsense Router-Traefik-Authelia(+extra header security)-FoundryVTT(no header security, fundamentally incompatible with any and all security)