fix(ownership): change Kong permissions to be kong:root

alpine/Dockerfile

@@ -33,18 +33,17 @@ RUN set -eux; \
       apk upgrade; \
     fi; \
     mkdir /kong \
+    && addgroup -S kong \
+    && adduser -S -G kong kong \
     && tar -C /kong -xzf /tmp/kong.tar.gz \
+    && chown -R root:kong /kong \
+    && chmod -R g=u /kong \
     && mv /kong/usr/local/* /usr/local \
     && mv /kong/etc/* /etc \
     && rm -rf /kong \
+    && rm -rf /tmp/kong.tar.gz \
     && apk add --no-cache libstdc++ libgcc openssl pcre perl tzdata libcap zip bash zlib zlib-dev git ca-certificates \
-    && adduser -S kong \
-    && addgroup -S kong \
     && mkdir -p "/usr/local/kong" \
-    && chown -R kong:0 /usr/local/kong \
-    && chown kong:0 /usr/local/bin/kong \
-    && chmod -R g=u /usr/local/kong \
-    && rm -rf /tmp/kong.tar.gz \
     && ln -s /usr/local/openresty/bin/resty /usr/local/bin/resty \
     && ln -s /usr/local/openresty/luajit/bin/luajit /usr/local/bin/luajit \
     && ln -s /usr/local/openresty/luajit/bin/luajit /usr/local/bin/lua \

tests/05-ownership.test.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+function run_test {
+  # the suite name below will only be used when running this file directly, when
+  # running through "test.sh" it must be provided using the "--suite" option.
+  tinitialize "Docker-Kong test suite" "${BASH_SOURCE[0]}"
+
+  tchapter "ownership is root:kong"
+
+
+  for filename in \
+    /usr/local/share/lua/5.1/ \
+    /usr/local/share/lua/5.1/kong/plugins/ \
+    /usr/local/lib/lua/5.1/ \
+    /usr/local/lib/luarocks/rocks-5.1/
+  do
+    ttest "owenership $filename"
+    local USR
+    local GRP
+    USR=$(docker run -ti --rm "kong-$BASE" ls -ld $filename | awk '{print $3}')
+    GRP=$(docker run -ti --rm "kong-$BASE" ls -ld $filename | awk '{print $4}')
+    if [ "$USR:$GRP" == "root:kong" ]; then
+      tsuccess
+    else
+      tmessage "user and group found to be $USR:$GRP"
+      tfailure
+    fi
+  done
+
+  tfinish
+}
+
+# No need to modify anything below this comment
+
+# shellcheck disable=SC1090  # do not follow source
+[[ "$T_PROJECT_NAME" == "" ]] && set -e && if [[ -f "${1:-$(dirname "$(realpath "$0")")/test.sh}" ]]; then source "${1:-$(dirname "$(realpath "$0")")/test.sh}"; else source "${1:-$(dirname "$(realpath "$0")")/run.sh}"; fi && set +e
+run_test