Merge pull request #1375 from basecamp/fix-docker-permissions

Run code as the rails user

Dockerfile

@@ -63,6 +63,11 @@ COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer
 
+# Run and own only the runtime files as a non-root user for security
+RUN useradd rails --create-home --shell /bin/bash && \
+    chown -R rails:rails db log storage tmp
+USER rails:rails
+
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]