From f3ac45550e706429eae67d2042f661f491317a80 Mon Sep 17 00:00:00 2001
From: "Alexander A. Klimov" <alexander.klimov@icinga.com>
Date: Tue, 9 Jul 2024 13:20:46 +0200
Subject: [PATCH] Do not run as root, for security reasons

---
 Containerfile | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Containerfile b/Containerfile
index 194ef1dc..18a26913 100644
--- a/Containerfile
+++ b/Containerfile
@@ -9,6 +9,15 @@ RUN CGO_ENABLED=0 GOOS=linux go build -o /icinga-kubernetes cmd/icinga-kubernete
 
 FROM scratch
 
+COPY <<EOF /etc/group
+icinga-kubernetes:x:101:
+EOF
+
+COPY <<EOF /etc/passwd
+icinga-kubernetes:*:101:101::/nonexistent:/usr/sbin/nologin
+EOF
+
 COPY --from=build /icinga-kubernetes /icinga-kubernetes
 
+USER icinga-kubernetes
 CMD ["/icinga-kubernetes"]