Improve docker entrypoint to work rootless

* The previous behavior required root privileges on start, now this is
optional (when run in rootless mode with --user). The user has to ensure
the correct ownership is set for existing data in that case.

* Furthermore, it is now possible to choose to keep root privileges by
setting KEEP_PRIVILEGES to something non-empty.

* This also renames abc user to changedetection (nicer).

Dockerfile

@@ -50,8 +50,8 @@ RUN set -ex; \
         zlib1g && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*; \
-    useradd -u 911 -U -d /datastore -s /bin/false abc && \
-    usermod -G users abc; \
+    useradd -u 911 -U -d /datastore -s /bin/false changedetection && \
+    usermod -G users changedetection; \
     mkdir -p /datastore
 
 # https://stackoverflow.com/questions/58701233/docker-logs-erroneously-appears-empty-until-container-stops
@@ -68,7 +68,7 @@ EXPOSE 5000
 
 # The entrypoint script handling PUID/PGID and permissions
 COPY docker-entrypoint.sh /app/docker-entrypoint.sh
-RUN chmod u+x /app/docker-entrypoint.sh
+RUN chmod 777 /app/docker-entrypoint.sh
 
 # The actual flask app module
 COPY changedetectionio /app/changedetectionio
@@ -81,4 +81,5 @@ ARG LOGGER_LEVEL=''
 ENV LOGGER_LEVEL "$LOGGER_LEVEL"
 
 WORKDIR /app
-CMD ["/app/docker-entrypoint.sh"]
+ENTRYPOINT ["/app/docker-entrypoint.sh"]
+CMD ["python", "./changedetection.py", "-d", "/datastore"]

docker-entrypoint.sh

@@ -1,11 +1,27 @@
 #!/bin/bash
 
-PUID=${PUID:-911}
-PGID=${PGID:-911}
+set -eu
 
-groupmod -o -g "$PGID" abc
-usermod -o -u "$PUID" abc
+# If the first argument looks like a flag, assume we want to run changedetection
+if [ "${1:0:1}" = '-' ]; then
+    set -- python ./changedetection.py -d /datastore "$@"
+fi
 
-chown -R abc:abc /datastore
+# If we're running as root, by default make sure process uid/gid
+# and datadir permissions are correct. This can be skipped by setting
+# KEEP_PRIVILEGES to something non-empty.
+if [ "$(id -u)" = '0' -a -n "${KEEP_PRIVILEGES:-}" ]; then
+    PUID=${PUID:-911}
+    PGID=${PGID:-911}
 
-exec gosu abc:abc python ./changedetection.py -d /datastore
+    groupmod -o -g "$PGID" changedetection
+    usermod -o -u "$PUID" changedetection
+
+    # Look for files in datadir not owned by the correct user and chown them
+    find "/datastore" \! -user changedetection -exec chown changedetection '{}' +
+
+    # Restart this script as an unprivileged user
+    exec gosu changedetection:changedetection "$BASH_SOURCE" "$@"
+fi
+
+exec "$@"