f91a8b2462
Set default container user/group to lower privilege app user * refactor: update Containerfile to support non-root user execution and improve security - Updated LS_VER argument from 89 to 170 to use the latest version - Added UID/GID arguments with default values of 0 (root) for backward compatibility - Added USER_HOME environment variable set to /root - Implemented conditional user/group creation logic that only runs when UID/GID are not 0 - Created necessary directory structure with proper ownership using mkdir and chown commands - Switched to non-root user execution for improved security posture - Updated COPY instruction to use --chown flag for proper file ownership * chore: update containerfile to use non-root user with proper UID/GID - Changed default UID and GID from 0 (root) to 10001 for security best practices - Updated USER_HOME from /root to /app to avoid running as root user
39 lines
1014 B
Docker
39 lines
1014 B
Docker
ARG BASE_TAG=server-cuda
|
|
FROM ghcr.io/ggml-org/llama.cpp:${BASE_TAG}
|
|
|
|
# has to be after the FROM
|
|
ARG LS_VER=170
|
|
|
|
# Set default UID/GID arguments
|
|
ARG UID=10001
|
|
ARG GID=10001
|
|
ARG USER_HOME=/app
|
|
|
|
# Add user/group
|
|
ENV HOME=$USER_HOME
|
|
RUN if [ $UID -ne 0 ]; then \
|
|
if [ $GID -ne 0 ]; then \
|
|
addgroup --system --gid $GID app; \
|
|
fi; \
|
|
adduser --system --no-create-home --uid $UID --gid $GID \
|
|
--home $USER_HOME app; \
|
|
fi
|
|
|
|
# Handle paths
|
|
RUN mkdir --parents $HOME /app
|
|
RUN chown --recursive $UID:$GID $HOME /app
|
|
|
|
# Switch user
|
|
USER $UID:$GID
|
|
|
|
WORKDIR /app
|
|
RUN \
|
|
curl -LO https://github.com/mostlygeek/llama-swap/releases/download/v"${LS_VER}"/llama-swap_"${LS_VER}"_linux_amd64.tar.gz && \
|
|
tar -zxf llama-swap_"${LS_VER}"_linux_amd64.tar.gz && \
|
|
rm llama-swap_"${LS_VER}"_linux_amd64.tar.gz
|
|
|
|
COPY --chown=$UID:$GID config.example.yaml /app/config.yaml
|
|
|
|
HEALTHCHECK CMD curl -f http://localhost:8080/ || exit 1
|
|
ENTRYPOINT [ "/app/llama-swap", "-config", "/app/config.yaml" ]
|