2-Dockerfile-do-not-run-as-root

# Continue with the previous dockerfile
# Add a service account to the Docker image:
# RUN addgroup --system javauser && adduser -S -s /usr/sbin/nologin -G javauser javauser
#
# Change the ownership of the application directory:
# RUN chown -R javauser:javauser /opt/app
#
# Use the service account:
# USER javauser
#
# Build the image
# Run the container
# Verify it builds and starts successfully
# View the logs and verify that the container is started by the service account using the command:
# docker logs dockerbestpractices
FROM eclipse-temurin:17.0.7_7-jre-alpine@sha256:dd8238c151293ae6a7c22898ef2f0df2af8a05786aef73ccd3248e73765969ed
RUN mkdir /opt/app
RUN addgroup --system javauser && adduser -S -s /usr/sbin/nologin -G javauser javauser
ARG JAR_FILE
ADD target/${JAR_FILE} /opt/app/app.jar
RUN chown -R javauser:javauser /opt/app
USER javauser
CMD ["java", "-jar", "/opt/app/app.jar"]