non-root user

[rseleven]

Running a Container With a Non Root User

[Bert-R]

The intend is good, but the current approach does not work:

• The content is not added properly (see my other comment)
• Kafdrop does not run anymore. This is because the working directory is set to /, which is only writable by root. Due to that, the touch operations of kafdrop.sh all fail. The right way to fix that is by adding the application in /app and make that the working directory. However, that requires changes in Dockerfile, kafdrop.sh and the README

[Bert-R]

This won't work: the ``ADD` command extracts the zip file. Now it's just copied.

[rseleven]

• replace-dependencies: com.spotify.docker-maven-plugin:1.22 -> io.fabric8.docker-maven-plugin:0.43.0
• fix "Dockerfile"
• fix "kafdrop.sh"

when using com.spotify.docker-maven-plugin:1.22 there were problems with https://docs.docker.com/build/buildkit/

[Bert-R]

Thanks for the follow-up!
Unfortunately, the build didn't work anymore because the newly selected plug-in uses different configuration parameters.

I've looked into it and feel we can work with a much simplified Dockerfile, while still using the 'old' Spotify Docker plug-in. See my comments.

To test locally, you would need to do a local chmod +x src/main/docker/kafdrop.sh until @davideicardi has reviewed and merged #539.

[Bert-R]

Please revert this change, as the current change is incomplete, leading to these warnings that make the image build fail:

[WARNING] Parameter 'dockerDirectory' is unknown for plugin 'docker-maven-plugin:0.43.0:build (default-cli)'
[WARNING] Parameter 'imageName' is unknown for plugin 'docker-maven-plugin:0.43.0:build (default-cli)'
[WARNING] Parameter 'forceTags' is unknown for plugin 'docker-maven-plugin:0.43.0:build (default-cli)'
[WARNING] Parameter 'resources' is unknown for plugin 'docker-maven-plugin:0.43.0:build (default-cli)'
[WARNING] Parameter 'imageTags' is unknown for plugin 'docker-maven-plugin:0.43.0:build (default-cli)'

With that, pom.xml can be removed from your change set.

[Bert-R]

This became a lot more complex than it used to be. Let's simplify this.

• Through ADD, Docker can extract the zip to the /opt/kafdrop. That causes a bit of an ugly directory structure, but nobody needs to go through it, so it doesn't matter
• The chmod can be prevented by adding the execution permission in Git. I created Make kafdrop.sh executable #539 for that

With these changes, the Dockerfile can be come this simple:

FROM eclipse-temurin:17.0.7_7-jdk

WORKDIR /opt/kafdrop
ADD kafdrop*tar.gz .
COPY kafdrop.sh .

RUN groupadd -g 1000 kafdrop && \
    useradd -u 1000 -g kafdrop kafdrop && \
    chown --recursive kafdrop:kafdrop /opt/kafdrop

USER kafdrop

ENV PATH="/opt/java/openjdk/bin:$PATH"

EXPOSE 9000

ENTRYPOINT ["/opt/kafdrop/kafdrop.sh"]

[Bert-R]

Due to the above mentioned changes, this path needs to be changed:

Suggested change

	exec java $ARGS -jar /opt/kafdrop/kafdrop*.jar ${CMD_ARGS}
	exec java $ARGS -jar /opt/kafdrop/kafdrop*/kafdrop*jar ${CMD_ARGS}