Merge pull request #98 from linuxserver/3.21

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:3.21
 
 # set version label
 ARG BUILD_DATE

Dockerfile.aarch64

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.21
 
 # set version label
 ARG BUILD_DATE

README.md

@@ -75,6 +75,10 @@ This image can be run with a read-only container filesystem. For details please
 
 `/tmp` must also be mounted to tmpfs for this image.
 
+## Non-Root Operation
+
+This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).
+
 ## Usage
 
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
@@ -123,6 +127,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
 | `-v /config` | Persistent config files |
 | `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
+| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
 
 ## Environment variables from files (Docker secrets)
 

readme-vars.yml

@@ -20,6 +20,7 @@ param_volumes:
 readonly_supported: true
 readonly_message: |
   `/tmp` must also be mounted to tmpfs for this image.
+nonroot_supported: true
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |

root/etc/s6-overlay/s6-rc.d/init-ddclient-config/run

@@ -11,11 +11,13 @@ if [[ ! -e /config/ddclient.conf ]]; then
     cp /defaults/ddclient.conf /config
 fi
 
-# permissions
-lsiown -R abc:abc \
-    /config \
-    /run/ddclient \
-    /run/ddclient-cache
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    # permissions
+    lsiown -R abc:abc \
+        /config \
+        /run/ddclient \
+        /run/ddclient-cache
+fi
 
 chmod 700 \
     /config \

root/etc/s6-overlay/s6-rc.d/svc-ddclient/run

@@ -1,5 +1,10 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
-exec \
-    s6-setuidgid abc /usr/bin/ddclient --foreground --file /config/ddclient.conf --cache /run/ddclient-cache/ddclient.cache
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    exec \
+        s6-setuidgid abc /usr/bin/ddclient --foreground --file /config/ddclient.conf --cache /run/ddclient-cache/ddclient.cache
+else
+    exec \
+        /usr/bin/ddclient --foreground --file /config/ddclient.conf --cache /run/ddclient-cache/ddclient.cache
+fi

root/etc/s6-overlay/s6-rc.d/svc-inotify/run

@@ -3,7 +3,9 @@
 
 # starting inotify to watch /config/ddclient.conf and restart ddclient if changed.
 while inotifywait -e modify /config/ddclient.conf; do
-    lsiown abc:abc /config/ddclient.conf
+    if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+        lsiown abc:abc /config/ddclient.conf
+    fi
     chmod 600 /config/ddclient.conf
     s6-svc -h /run/service/svc-ddclient
     echo "ddclient has been restarted"