feat(hass): run as non-root (#1023)

onedr0p · May 15, 2024 · a1e30b0 · a1e30b0
1 parent 85811a6
commit a1e30b0
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/apps/home-assistant/Dockerfile b/apps/home-assistant/Dockerfile
@@ -91,6 +91,9 @@ RUN \
     uv pip install --system --only-binary=:all: --find-links "${HOMEASSISTANT_WHEELS}" \
         homeassistant=="${VERSION}" \
     && \
+    mkdir -p /config \
+    && chown nobody:nogroup -R /config \
+    && \
     apk del --purge .build-deps \
     && \
     rm -rf \
@@ -100,6 +103,10 @@ RUN \
 
 COPY ./apps/home-assistant/entrypoint.sh /entrypoint.sh
 
+USER nobody:nogroup
+WORKDIR /config
+VOLUME ["/config"]
+
 ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 

diff --git a/apps/home-assistant/entrypoint.sh b/apps/home-assistant/entrypoint.sh
@@ -1,13 +1,10 @@
 #!/usr/bin/env bash
 
-mkdir -p /config/logs
-
 if [[ "${HOME_ASSISTANT__HACS_INSTALL}" == "true" ]]; then
     curl -sfSL https://hacs.xyz/install | bash -
 fi
 
 exec \
     /usr/local/bin/hass \
         --config /config \
-        --log-file /config/logs/home-assistant.log \
         "$@"