Optimize Nut-server Docker configuration and security

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.gitignore
+Dockerfile
+README.md
+*.log
+__pycache__
+.dockerignore

Dockerfile

@@ -5,42 +5,40 @@ LABEL description='Slim Docker container featuring embedded Nut server from blaw
 LABEL repo='eskwisit/nut-server'
 LABEL email='mru2683@gmail.com'
 
-# Prepare Nut install
-RUN apt-get update && apt-get -y install \
-	wget \
-	unzip \
-	gcc \
-	libssl-dev \
-	libcurl4-openssl-dev \
-	zlib1g-dev \
-	libjpeg-dev
-
-# Fetch Nut codebase
-RUN wget https://github.com/blawar/nut/archive/refs/tags/v3.3.zip
-RUN unzip v3.3.zip -d /root
-RUN mv /root/nut-3.3 /root/nut
-
-# Edit config
-RUN mv /root/nut/conf/nut.default.conf /root/nut/conf/nut.conf
-RUN sed -i '/scan/c "scan": ["\/titles"]' /root/nut/conf/nut.conf
-
-# Remove GUI packages
-RUN sed -i '/pyqt5/d' /root/nut/requirements.txt
-RUN sed -i '/qt-range-slider/d' /root/nut/requirements.txt
-
-# Add missing requirements
-RUN echo markupsafe==2.0.1 >>/root/nut/requirements.txt
-
-# Install project dependencies
-RUN pip3 install -U pip
-RUN pip3 install -r /root/nut/requirements.txt
-
-VOLUME [ "/titles", "/root/nut/conf", "/root/nut/_NSPOUT" ]
+# Create non-root user
+RUN groupadd -g 1000 nut && \
+    useradd -u 1000 -g nut -m -d /app nut
+
+WORKDIR /app
+
+# Install build dependencies, fetch Nut, patch, install python deps, and cleanup
+RUN apt-get update && apt-get -y install --no-install-recommends \
+    curl \
+    ca-certificates \
+    gcc \
+    libssl-dev \
+    libcurl4-openssl-dev \
+    zlib1g-dev \
+    libjpeg-dev \
+    && curl -L https://github.com/blawar/nut/archive/refs/tags/v3.3.tar.gz | tar -xz --strip-components=1 -C /app \
+    && mv /app/conf/nut.default.conf /app/conf/nut.conf \
+    && sed -i '/scan/c "scan": ["\/titles"]' /app/conf/nut.conf \
+    && sed -i '/pyqt5/d' /app/requirements.txt \
+    && sed -i '/qt-range-slider/d' /app/requirements.txt \
+    && echo "markupsafe==2.0.1" >> /app/requirements.txt \
+    && pip3 install -U --no-cache-dir pip \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && apt-get purge -y --auto-remove curl gcc libssl-dev libcurl4-openssl-dev zlib1g-dev libjpeg-dev \
+    && apt-get install -y --no-install-recommends libcurl4 libjpeg62-turbo \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /titles /app/_NSPOUT /app/conf \
+    && chown -R nut:nut /app /titles
+
+VOLUME [ "/titles", "/app/conf", "/app/_NSPOUT" ]
 
 EXPOSE 9000
 
-# clean up
-RUN rm v3.3.zip
-RUN apt-get autoremove
+USER nut
 
-CMD ["python3", "/root/nut/nut.py", "--server"]
+CMD ["python3", "/app/nut.py", "--server"]

README.md

@@ -10,6 +10,7 @@ Slim Docker image featuring embedded Nut server from [blawar/nut](https://github
 - Auto refresh of titles directory.
 - Zero config bundle.
 - Seamless integration for [Tinfoil](https://tinfoil.io/).
+- **Improved security:** Runs as a non-root user.
 
 ## Usage
 
@@ -18,6 +19,7 @@ Slim Docker image featuring embedded Nut server from [blawar/nut](https://github
 docker pull eskwisit/nut-server
 
 # Run image
+# Ensure your local titles directory is accessible by the 'nut' user (UID 1000)
 docker run -d --name=nut-server -v /path/to/titles:/titles:rw eskwisit/nut-server
 ```
 
@@ -27,6 +29,8 @@ If you need to tune the configuration, you can mount titles, conf and NSPOUT vol
 
 ```bash
 -v /path/to/titles:/titles:rw # For titles
--v /path/to/conf:/root/nut/conf:rw # For config files
--v /path/to/_NSPOUT:/root/nut/_NSPOUT/:rw # For NSP out
+-v /path/to/conf:/app/conf:rw # For config files
+-v /path/to/_NSPOUT:/app/_NSPOUT/:rw # For NSP out
 ```
+
+*Note: Since the container runs as a non-root user (UID 1000), you may need to adjust the permissions of your host folders to ensure the container can read/write them.*