Add non-root flutter user to all SDK images

Creates a dedicated flutter user and switches to it as the default.
Resolves Docker Scout compliance check for non-root default user.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/publish.yaml

@@ -7,6 +7,9 @@ on:
 permissions:
   contents: read
 
+env:
+  IMAGE_NAME: flutter-sdk
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -14,13 +17,13 @@ jobs:
       matrix:
         include:
           - dockerfile: Dockerfile
-            image_name: gpb-flutter-sdk-web
+            variant: web
             description: Minimal Flutter SDK for Web/WASM CI builds
           - dockerfile: Dockerfile.android
-            image_name: gpb-flutter-sdk-android
+            variant: android
             description: Flutter SDK for Android CI builds
           - dockerfile: Dockerfile.linux
-            image_name: gpb-flutter-sdk-linux
+            variant: linux
             description: Flutter SDK for Linux desktop CI builds
     steps:
       - name: Checkout code
@@ -34,12 +37,12 @@ jobs:
             FLUTTER_VERSION=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json \
               | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
             echo "flutter_version=${FLUTTER_VERSION}" >> $GITHUB_OUTPUT
-            echo "tag=dev" >> $GITHUB_OUTPUT
+            echo "tag=${{ matrix.variant }}-dev" >> $GITHUB_OUTPUT
             echo "Using latest Flutter stable ${FLUTTER_VERSION} for pre-release test"
           else
             # Full release: use the release tag as the Flutter version
             echo "flutter_version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
-            echo "tag=latest" >> $GITHUB_OUTPUT
+            echo "tag=${{ matrix.variant }}-latest" >> $GITHUB_OUTPUT
           fi
 
       - name: Set up Docker Buildx
@@ -61,7 +64,7 @@ jobs:
           load: true
           build-args: |
             FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
-          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }}
+          tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
 
       - name: Install Docker Scout
         run: |
@@ -70,7 +73,7 @@ jobs:
 
       - name: Docker Scout CVE Scan
         run: |
-          docker scout cves ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }} --only-severity critical,high
+          docker scout cves ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }} --only-severity critical,high
 
       - name: Build and push with attestations
         uses: docker/build-push-action@v5
@@ -84,10 +87,10 @@ jobs:
           build-args: |
             FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
           tags: |
-            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.flutter_version }}
+            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
-            ${{ vars.REGISTRY }}/${{ matrix.image_name }}:${{ steps.version.outputs.tag }}
+            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
           labels: |
-            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.description=${{ matrix.description }}
-            org.opencontainers.image.version=${{ steps.version.outputs.flutter_version }}
+            org.opencontainers.image.version=${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
             org.opencontainers.image.revision=${{ github.sha }}

.gitea/workflows/scout.yaml

@@ -8,6 +8,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  IMAGE_NAME: flutter-sdk
+
 jobs:
   scout:
     runs-on: ubuntu-latest
@@ -15,11 +18,11 @@ jobs:
       matrix:
         include:
           - dockerfile: Dockerfile
-            image_name: gpb-flutter-sdk-web
+            variant: web
           - dockerfile: Dockerfile.android
-            image_name: gpb-flutter-sdk-android
+            variant: android
           - dockerfile: Dockerfile.linux
-            image_name: gpb-flutter-sdk-linux
+            variant: linux
     steps:
       - name: Log in to DockerHub
         uses: docker/login-action@v3
@@ -30,12 +33,12 @@ jobs:
       - name: Check if latest image exists
         id: should_run
         run: |
-          if docker manifest inspect ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest > /dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest > /dev/null 2>&1; then
             echo "run=true" >> $GITHUB_OUTPUT
-            echo "Latest ${{ matrix.image_name }} found, Scout compare will run"
+            echo "${{ matrix.variant }}-latest found, Scout compare will run"
           else
             echo "run=false" >> $GITHUB_OUTPUT
-            echo "No latest ${{ matrix.image_name }} found, skipping (nothing to compare against)"
+            echo "No ${{ matrix.variant }}-latest found, skipping (nothing to compare against)"
           fi
 
       - name: Checkout code
@@ -55,7 +58,7 @@ jobs:
           platforms: linux/amd64
           push: false
           load: true
-          tags: ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }}
+          tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-pr-${{ github.event.pull_request.number }}
 
       - name: Install Docker Scout
         if: steps.should_run.outputs.run == 'true'
@@ -66,4 +69,4 @@ jobs:
       - name: Docker Scout Compare
         if: steps.should_run.outputs.run == 'true'
         run: |
-          docker scout compare ${{ vars.REGISTRY }}/${{ matrix.image_name }}:pr-${{ github.event.pull_request.number }} --to ${{ vars.REGISTRY }}/${{ matrix.image_name }}:latest --ignore-unchanged --only-severity critical,high
+          docker scout compare ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-pr-${{ github.event.pull_request.number }} --to ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest --ignore-unchanged --only-severity critical,high

Dockerfile

@@ -2,7 +2,7 @@ FROM debian:bookworm-slim
 
 ARG FLUTTER_VERSION=3.38.9
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-web"
+LABEL org.opencontainers.image.title="flutter-sdk"
 LABEL org.opencontainers.image.description="Minimal Flutter SDK for Web/WASM CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
@@ -48,4 +48,10 @@ RUN flutter precache --web \
 # Verify installation
 RUN flutter doctor -v
 
+# Create non-root user for CI builds
+RUN groupadd -r flutter && useradd -r -g flutter -m -d /home/flutter flutter && \
+    chown -R flutter:flutter "${FLUTTER_HOME}" /home/flutter
+
 WORKDIR /app
+RUN chown flutter:flutter /app
+USER flutter

Dockerfile.android

@@ -5,7 +5,7 @@ ARG ANDROID_SDK_TOOLS_VERSION=11076708
 ARG ANDROID_COMPILE_SDK=35
 ARG ANDROID_BUILD_TOOLS=35.0.1
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-android"
+LABEL org.opencontainers.image.title="flutter-sdk"
 LABEL org.opencontainers.image.description="Flutter SDK for Android CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
@@ -69,4 +69,10 @@ RUN flutter precache --android \
 
 RUN flutter doctor -v
 
+# Create non-root user for CI builds
+RUN groupadd -r flutter && useradd -r -g flutter -m -d /home/flutter flutter && \
+    chown -R flutter:flutter "${FLUTTER_HOME}" "${ANDROID_HOME}" /home/flutter
+
 WORKDIR /app
+RUN chown flutter:flutter /app
+USER flutter

Dockerfile.linux

@@ -2,7 +2,7 @@ FROM debian:bookworm-slim
 
 ARG FLUTTER_VERSION=3.38.9
 
-LABEL org.opencontainers.image.title="gpb-flutter-sdk-linux"
+LABEL org.opencontainers.image.title="flutter-sdk"
 LABEL org.opencontainers.image.description="Flutter SDK for Linux desktop CI builds"
 LABEL org.opencontainers.image.version="${FLUTTER_VERSION}"
 
@@ -52,4 +52,10 @@ RUN flutter precache --linux \
 
 RUN flutter doctor -v
 
+# Create non-root user for CI builds
+RUN groupadd -r flutter && useradd -r -g flutter -m -d /home/flutter flutter && \
+    chown -R flutter:flutter "${FLUTTER_HOME}" /home/flutter
+
 WORKDIR /app
+RUN chown flutter:flutter /app
+USER flutter

PLAN.md

@@ -0,0 +1,259 @@
+# Custom Minimal Flutter SDK Distribution
+
+## Goal
+
+Build Flutter SDK from source in a multi-stage Docker build, then copy only the compiled SDK and its runtime dependencies into a custom minimal Linux base image. The result is a secure, minimal container with zero build toolchain bloat.
+
+## Architecture
+
+```
+┌─────────────────────────────────────┐
+│  Stage 1: BUILD (debian:bookworm)   │
+│                                     │
+│  - Full build toolchain             │
+│  - Compile Flutter engine + Dart    │
+│  - All build-time deps              │
+│  - Discarded after build            │
+└──────────────┬──────────────────────┘
+               │ COPY artifacts
+               ▼
+┌─────────────────────────────────────┐
+│  Stage 2: RUNTIME (custom base)     │
+│                                     │
+│  - Minimal glibc + runtime libs     │
+│  - Flutter SDK (pre-compiled)       │
+│  - Only what's needed to run        │
+│    `flutter build` commands         │
+└─────────────────────────────────────┘
+```
+
+## Approach: apko + melange on Wolfi
+
+Use Chainguard's open-source tooling to build the runtime base image from Wolfi packages. This avoids maintaining a full Linux distribution while achieving the same result.
+
+### Why Wolfi (not Alpine, not from scratch)
+
+- **glibc-based**: Flutter/Dart require glibc (musl/Alpine won't work)
+- **apk package format**: Minimal, fast, composable
+- **15,000+ packages**: glibc, libstdc++, git, curl, ca-certificates all available
+- **Nightly CVE patching**: Chainguard patches 80%+ of vulnerabilities within 24 hours
+- **No distro maintenance burden**: We consume their packages, not maintain them
+
+### Tools
+
+| Tool | Purpose |
+|---|---|
+| **melange** | Build custom APK packages (Flutter SDK, Android SDK) from source |
+| **apko** | Compose final OCI image from APK packages (Wolfi base + custom) |
+
+## Stage 1: Build Flutter from Source
+
+Flutter SDK source build requirements:
+- git (clone flutter/flutter and flutter/engine repos)
+- Python 3 (engine build scripts)
+- curl, unzip, xz-utils
+- clang/llvm (engine compilation)
+- ninja-build, gn (engine build system)
+- libstdc++-dev
+- Dart SDK (bootstrapped from prebuilt, then rebuilt)
+
+Flutter engine build steps:
+1. Clone `flutter/engine` at the pinned revision from `flutter/flutter/bin/internal/engine.version`
+2. Run `gclient sync` to fetch dependencies
+3. Build with `gn` + `ninja` for target platform
+4. Dart SDK is built as part of the engine
+
+### Per-Variant Build Targets
+
+| Variant | Engine build target | Extra build deps | Extra runtime deps |
+|---|---|---|---|
+| **web** | `host_release` (dart2js/dart2wasm) | None | None |
+| **android** | `android_release` + `android_release_arm64` | Android NDK | JDK 17, Android SDK cmdline-tools |
+| **linux** | `linux_release_x64` | GTK3-dev, CMake | GTK3 runtime libs |
+
+## Stage 2: Custom Runtime Base via apko
+
+### Web variant (minimal)
+
+```yaml
+# apko.web.yaml
+contents:
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+  repositories:
+    - https://packages.wolfi.dev/os
+    - @local /packages  # our melange-built Flutter SDK package
+  packages:
+    - wolfi-baselayout
+    - glibc
+    - libstdc++
+    - git
+    - ca-certificates-bundle
+    - flutter-sdk-web@local
+entrypoint:
+  command: /bin/sh
+environment:
+  FLUTTER_HOME: /opt/flutter
+  PATH: /opt/flutter/bin:/opt/flutter/bin/cache/dart-sdk/bin:/usr/bin:/bin
+archs:
+  - x86_64
+```
+
+### Android variant
+
+Same as web plus:
+- `openjdk-17-jre` (from Wolfi)
+- `flutter-sdk-android@local` (custom package including Android SDK components)
+
+### Linux desktop variant
+
+Same as web plus:
+- `gtk+3.0` runtime libs (from Wolfi, or custom melange package if not available)
+- `flutter-sdk-linux@local`
+
+## melange Package Definitions
+
+### flutter-sdk-web.melange.yaml (example structure)
+
+```yaml
+package:
+  name: flutter-sdk-web
+  version: 3.38.9
+  epoch: 0
+  description: Flutter SDK for Web/WASM builds (compiled from source)
+
+environment:
+  contents:
+    packages:
+      - build-base
+      - git
+      - python3
+      - curl
+      - unzip
+      - xz
+      - clang
+      - ninja
+      - gn
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/flutter/flutter.git
+      tag: ${{package.version}}
+      destination: flutter
+
+  - runs: |
+      # Bootstrap Dart SDK
+      flutter/bin/flutter --version
+
+      # Configure for web-only
+      flutter/bin/flutter config --enable-web \
+        --no-enable-android --no-enable-ios \
+        --no-enable-linux-desktop --no-enable-macos-desktop \
+        --no-enable-windows-desktop
+
+      # Precache web artifacts
+      flutter/bin/flutter precache --web \
+        --no-android --no-ios --no-linux \
+        --no-macos --no-windows --no-fuchsia --no-universal
+
+      # Install to package destination
+      mkdir -p ${{targets.destdir}}/opt
+      mv flutter ${{targets.destdir}}/opt/flutter
+
+      # Mark git safe directory
+      git config --global --add safe.directory /opt/flutter
+```
+
+## Implementation Phases
+
+### Phase 1: Proof of Concept (web variant only)
+
+1. Install melange and apko locally
+2. Write `flutter-sdk-web.melange.yaml` to package Flutter SDK
+3. Build the APK: `melange build flutter-sdk-web.melange.yaml`
+4. Write `apko.web.yaml` to compose the final image
+5. Build the image: `apko build apko.web.yaml flutter-sdk-web:test flutter-sdk-web.tar`
+6. Load and test: `docker load < flutter-sdk-web.tar`
+7. Verify: `docker run --rm flutter-sdk-web:test flutter doctor -v`
+8. Compare image size vs current debian:bookworm-slim approach
+
+### Phase 2: CI Pipeline
+
+1. Add melange + apko build steps to publish.yaml
+2. Multi-stage: melange builds APK → apko composes image → push to registry
+3. Scout CVE scan on the final image
+4. SBOM generation (apko generates SBOMs natively)
+
+### Phase 3: Android + Linux Desktop Variants
+
+1. Write melange packages for Android SDK components
+2. Write apko YAML for Android variant (add JDK from Wolfi)
+3. Write apko YAML for Linux variant (add GTK3 from Wolfi)
+4. Test each variant with real Flutter project builds
+
+### Phase 4: Automated Updates
+
+1. Daily update-check detects new Flutter stable release
+2. Triggers melange rebuild of Flutter SDK package
+3. apko recomposes image with latest Wolfi packages (picks up CVE fixes)
+4. Push new images to registry
+
+## Expected Image Sizes
+
+| Variant | Current (debian:bookworm-slim) | Target (Wolfi/apko) |
+|---|---|---|
+| Web | ~1.8 GB | ~1.2-1.4 GB |
+| Android | ~3.5 GB | ~2.5-3.0 GB |
+| Linux | ~2.2 GB | ~1.5-1.8 GB |
+
+Note: Flutter SDK itself is ~1+ GB regardless of base. The savings come from the base OS layer (74 MB debian-slim → ~14 MB Wolfi base) and elimination of build-time packages.
+
+## File Structure (Target)
+
+```
+docker-flutter-sdk/
+├── melange/
+│   ├── flutter-sdk-web.melange.yaml
+│   ├── flutter-sdk-android.melange.yaml
+│   └── flutter-sdk-linux.melange.yaml
+├── apko/
+│   ├── web.apko.yaml
+│   ├── android.apko.yaml
+│   └── linux.apko.yaml
+├── Dockerfile                    # Fallback: current debian approach (web)
+├── Dockerfile.android            # Fallback: current debian approach (android)
+├── Dockerfile.linux              # Fallback: current debian approach (linux)
+├── .gitea/
+│   └── workflows/
+│       ├── publish.yaml          # Build with melange+apko, push to registry
+│       ├── publish-dockerfile.yaml  # Fallback Dockerfile builds
+│       ├── scout.yaml
+│       └── update-check.yaml
+└── PLAN.md
+```
+
+## Risks and Mitigations
+
+| Risk | Mitigation |
+|---|---|
+| GTK3 dev libs not in Wolfi | Fall back to Dockerfile.linux with debian-slim for that variant |
+| Flutter engine source build is complex | Start with packaging prebuilt SDK, graduate to source build |
+| melange/apko learning curve | Well-documented by Chainguard, active community |
+| Wolfi package availability changes | Pin package versions, maintain fallback Dockerfiles |
+| Build times for source compilation | Cache melange build artifacts, only rebuild on new Flutter release |
+
+## Dependencies
+
+- melange CLI: `go install chainguard.dev/melange@latest`
+- apko CLI: `go install chainguard.dev/apko@latest`
+- Docker (for testing)
+- Signing key pair (for APK package signing)
+
+## References
+
+- [Wolfi Overview](https://edu.chainguard.dev/open-source/wolfi/overview/)
+- [Getting Started with apko](https://edu.chainguard.dev/open-source/build-tools/apko/getting-started-with-apko/)
+- [Getting Started with melange](https://edu.chainguard.dev/open-source/build-tools/melange/getting-started-with-melange/)
+- [Flutter Engine Build Instructions](https://github.com/flutter/flutter/wiki/Compiling-the-engine)
+- [wolfi-dev/os packages](https://github.com/wolfi-dev/os)