Support running the container with arbitrary non-root users (#334)

Fixes #331
Co-authored-by: nathan <nathan@nzm.ca>

Dockerfile

@@ -3,12 +3,7 @@ FROM ubuntu:latest AS base
 
 ARG GITHUB_BUILD=false \
     UV_CACHE_DIR=/var/cache/uv \
-    VERSION \
-    USER=ubuntu \
-    UID=1000
-
-ARG GROUP=${USER} \
-    GID=${UID}
+    VERSION
 
 ENV GITHUB_BUILD=${GITHUB_BUILD}\
     VERSION=${VERSION}\
@@ -18,7 +13,9 @@ ENV GITHUB_BUILD=${GITHUB_BUILD}\
     PYTHONDONTWRITEBYTECODE=1 \
     UV_LINK_MODE=copy \
     UV_CACHE_DIR=${UV_CACHE_DIR} \
-    PORT=8191
+    PORT=8191 \
+    XDG_CACHE_HOME=/cache \
+    HOME=/tmp
 
 RUN apt update &&\
     apt -y upgrade &&\
@@ -33,26 +30,26 @@ ENTRYPOINT [ "sleep", "infinity" ]
 
 FROM base AS app
 WORKDIR /app
-RUN chown ${USER}:${GROUP} /app &&\
-    mkdir -p ${UV_CACHE_DIR} &&\
-    chown ${USER}:${GROUP} ${UV_CACHE_DIR}
 
-USER ${USER}
 COPY pyproject.toml uv.lock ./
-RUN uv sync && uv run camoufox fetch
-
-USER root
-RUN uv run playwright install-deps firefox
-USER ${USER}
+RUN mkdir -p /cache &&\
+    uv sync &&\
+    uv run camoufox fetch &&\
+    uv run playwright install-deps firefox
 
 COPY . .
 
+# Make app and cache world-readable; addon scripts dir world-writable (runtime writes)
+RUN chmod -R o+rX /app /cache &&\
+    find /app/.venv -path "*/camoufox_add_init_script/addon" -type d -exec chmod -R o+rwX {} +
+
 FROM app AS test
 RUN \
     uv sync --group test &&\
     uv run pytest --retries 3
 
 FROM app
+USER 1000
 EXPOSE $PORT
 HEALTHCHECK --interval=15m --timeout=30s --start-period=5s --retries=3 CMD curl "http://localhost:${PORT}/health"
-ENTRYPOINT ["uv", "run", "main.py"]
+ENTRYPOINT ["/app/.venv/bin/python", "main.py"]