Merge branch 'GONRG-7392-non-root-images' into 'master'

GONRG-7392: use non-root user for images

See merge request !404

devops/gc/deploy/templates/deployment.yaml

@@ -38,7 +38,7 @@ spec:
           {{- end }}
           securityContext:
             allowPrivilegeEscalation: false
-            runAsUser: 0
+            runAsNonRoot: true
           ports:
             - containerPort: 8080
           resources:

provider/notification-gc/cloudbuild/Dockerfile.cloudbuild

@@ -6,5 +6,10 @@ ARG PORT
 ENV PORT $PORT
 # Copy the jar to the production image from the builder stage.
 COPY provider/notification-${PROVIDER_NAME}/target/notification-${PROVIDER_NAME}-*-spring-boot.jar notification-${PROVIDER_NAME}.jar
+# Add a non-root user
+RUN groupadd -g 10001 -r nonroot \
+  && useradd -g 10001 -r -u 10001 nonroot
+# Run as non-root user
+USER 10001:10001
 # Run the web service on container startup.
 CMD java -Djava.security.egd=file:/dev/./urandom -Dserver.port=${PORT} -Dlog4j.formatMsgNoLookups=true -jar /app/notification-${PROVIDER_NAME}.jar