Mathias Beaulieu-Duncan
74bb1f6070
- apko/sdk.yaml: run-as 65532, create /home/nonroot and /app owned by nonroot - sdk.Dockerfile: USER 65532, set HOME and DOTNET_CLI_HOME to /home/nonroot - README/DOCKERHUB: update examples to use COPY --chown=nonroot and /app/publish dotnet restore writes NuGet cache to $DOTNET_CLI_HOME/.nuget/packages which is now /home/nonroot/.nuget/packages — no root needed. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
49 lines
790 B
YAML
49 lines
790 B
YAML
contents:
|
|
repositories:
|
|
- https://packages.wolfi.dev/os
|
|
keyring:
|
|
- https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
|
|
packages:
|
|
- wolfi-baselayout
|
|
- glibc
|
|
- libstdc++
|
|
- ca-certificates-bundle
|
|
- libssl3
|
|
- zlib
|
|
- icu
|
|
- tzdata
|
|
- bash
|
|
- git
|
|
- curl
|
|
- coreutils
|
|
|
|
accounts:
|
|
groups:
|
|
- groupname: nonroot
|
|
gid: 65532
|
|
users:
|
|
- username: nonroot
|
|
uid: 65532
|
|
gid: 65532
|
|
run-as: 65532
|
|
|
|
paths:
|
|
- path: /home/nonroot
|
|
type: directory
|
|
uid: 65532
|
|
gid: 65532
|
|
permissions: 0o755
|
|
- path: /app
|
|
type: directory
|
|
uid: 65532
|
|
gid: 65532
|
|
permissions: 0o755
|
|
|
|
archs:
|
|
- x86_64
|
|
- aarch64
|
|
|
|
environment:
|
|
DOTNET_RUNNING_IN_CONTAINER: "true"
|
|
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: "false"
|