diff --git a/container/Dockerfile b/container/Dockerfile index 845de68..70fdbad 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -91,7 +91,8 @@ COPY dangerzone.py /usr/local/bin/ RUN chmod +x /usr/local/bin/dangerzone.py # Add the unprivileged user -RUN adduser -h /home/user -s /bin/sh -D user +RUN adduser -s /bin/sh -D dangerzone +USER dangerzone # /tmp/input_file is where the first convert expects the input file to be, and # /tmp where it will write the pixel files diff --git a/dangerzone/container.py b/dangerzone/container.py index 4a67857..0162e61 100644 --- a/dangerzone/container.py +++ b/dangerzone/container.py @@ -85,11 +85,13 @@ def convert(input_filename, output_filename, ocr_lang, stdout_callback): # drop all linux kernel capabilities security_args += ["--cap-drop", "all"] + user_args = ["-u", "dangerzone"] # Convert document to pixels args = ( ["run", "--network", "none"] + platform_args + + user_args + security_args + [ "-v", @@ -113,6 +115,7 @@ def convert(input_filename, output_filename, ocr_lang, stdout_callback): ["run", "--network", "none"] + platform_args + security_args + + user_args + [ "-v", f"{pixel_dir}:/dangerzone",