From fb061f33a1772a206dba626ae27ba59cb5217977 Mon Sep 17 00:00:00 2001 From: OpenCode Cabillot Date: Sun, 13 Sep 2026 14:41:49 +0000 Subject: [PATCH] fix(docker): pin numeric uid/gid so hadolint DL3066 passes hadolint 2.15.x - pulled in by hadolint-action v3.5.0 - adds DL3066 ("Non-numeric user-id may not be resolvable by host system"). The Dockerfile's `USER muser` trips it and the hadolint job exits 1 (hadolint fails on info-level findings by default), turning the PR Checks pipeline red on the Renovate bump PR. muser was created without an explicit uid/gid, so its numeric identity depended on busybox's auto-assignment. Both ids are now pinned at 1000:1000 - the values Alpine was already assigning - and USER uses the numeric form, which is always resolvable by the host. Verified with the upstream hadolint v2.15.1 binary: the previous Dockerfile reports "Dockerfile:9 DL3066 info" and exits 1, the fixed one lints clean and exits 0. The hadolint-action v3.3.0 -> v3.5.0 bump is included here (all four workflows, SHA 06be81ba) so that master ends up on v3.5.0 with a clean lint - superseding Renovate PR #23. --- .gitea/workflows/cron.yaml | 2 +- .gitea/workflows/main.yaml | 2 +- .gitea/workflows/pr.yaml | 2 +- .gitea/workflows/tag.yaml | 2 +- Dockerfile | 6 ++++-- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/cron.yaml b/.gitea/workflows/cron.yaml index 4394bb3..23076a5 100644 --- a/.gitea/workflows/cron.yaml +++ b/.gitea/workflows/cron.yaml @@ -11,7 +11,7 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Hadolint - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 continue-on-error: true build: diff --git a/.gitea/workflows/main.yaml b/.gitea/workflows/main.yaml index 61e157a..ecc5757 100644 --- a/.gitea/workflows/main.yaml +++ b/.gitea/workflows/main.yaml @@ -10,7 +10,7 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 with: dockerfile: Dockerfile diff --git a/.gitea/workflows/pr.yaml b/.gitea/workflows/pr.yaml index 5b79a55..62ed1e0 100644 --- a/.gitea/workflows/pr.yaml +++ b/.gitea/workflows/pr.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 with: dockerfile: Dockerfile diff --git a/.gitea/workflows/tag.yaml b/.gitea/workflows/tag.yaml index 3765868..bf1cb42 100644 --- a/.gitea/workflows/tag.yaml +++ b/.gitea/workflows/tag.yaml @@ -12,7 +12,7 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Hadolint - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 continue-on-error: true build: diff --git a/Dockerfile b/Dockerfile index 21d3af6..ea37e42 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,8 +4,10 @@ LABEL maintainer="Cabillot Julien " # hadolint ignore=DL3018 RUN apk add --no-cache mysql-client && \ rm -rf /usr/share/apk/keys && \ - adduser -D muser + addgroup -g 1000 muser && \ + adduser -D -u 1000 -G muser muser -USER muser +# Numeric uid/gid (DL3066): identity stays resolvable by the host +USER 1000:1000 ENTRYPOINT [ "/usr/bin/mysql" ] \ No newline at end of file -- 2.54.0