eoAPI and STAC Manager: Services should not run as root

[jonas-eberle]

Currently the service runs as root, which is not foreseen on the terrabyte platform. Thus, this should be changed to a "regular" user.

[pantierra]

Is this about the container user? And only STAC Manager? Or also other services?

[jonas-eberle]

Yes, is is about the container user and relates to STAC manager as well as other eoAPI services, e.g. stac-fastapi-pgstac (see https://github.com/stac-utils/stac-fastapi-pgstac/blob/main/Dockerfile). If nothing is specified, the container runs as root.

[pantierra]

Identified the following images running with unset root user:

• stac-fastapi-pgstac
• titiler-pgstac
• titiler-md-demo
• tipg
• stac-browser
• pgstac-pypgstac

Everything else (eoapi-notifier and external dependencies we pull in run as non-root).

[pantierra]

Created PRs on the upstream projects:

• Add non-root user for Docker container. stac-utils/stac-fastapi-pgstac#312
• Add non-root user for container. stac-utils/titiler-pgstac#237
• Add non-root user for container. developmentseed/tipg#242
• Add non-root user for container. developmentseed/titiler-md-demo#11
• Add non-root user for container. stac-utils/pgstac#390
• Run container as non-root user radiantearth/stac-browser#727

[pantierra]

Adding here the script i used to check the images.

check-images.sh