add non-root user

Dockerfile

@@ -27,19 +27,29 @@ FROM python:3.13-slim-bookworm
 ARG PUID=1000
 ARG PGID=1000
 
+# 1. System-Pakete (inkl. gosu)
+RUN apt-get update && apt-get install -y --no-install-recommends gosu \
+    && rm -rf /var/lib/apt/lists/*
+
+# 2. User anlegen
 RUN groupadd -g ${PGID} appgroup \
     && useradd -u ${PUID} -g appgroup -m -d /home/appuser appuser
 
+# 3. Scalable CLI kopieren
 COPY --from=builder /usr/local/bin/sc /usr/local/bin/sc
 
+# 4. App-Dateien
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
-
 COPY scalable_sync.py .
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
+# 5. Env
 ENV SC_CONFIG_DIR=/tmp/sc-config
+ENV PUID=${PUID}
+ENV PGID=${PGID}
 
-USER ${PUID}:${PGID}
-
-ENTRYPOINT ["python", "/app/scalable_sync.py"]
+# 6. Entrypoint (wechselt intern auf appuser)
+ENTRYPOINT ["/entrypoint.sh"]

compose.yaml

@@ -11,8 +11,8 @@ services:
     container_name: scalable-sync
     restart: unless-stopped
     user: "${PUID}:${PGID}"
-    networks:
-      - ext_net
+#    networks:
+#      - ext_net
     volumes:
       - scalable-sync-data:/app/data
       - scalable-sync-config:/tmp/sc-config
@@ -25,9 +25,9 @@ services:
       retries: 3
       start_period: 30s
 
-networks:
-  ext_net:
-    external: true
+#networks:
+#  ext_net:
+#    external: true
 
 volumes:
   scalable-sync-data:

entrypoint.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+# Berechtigungen für Volumes setzen (als root)
+chown -R ${PUID:-1000}:${PGID:-1000} /app/data /tmp/sc-config 2>/dev/null || true
+chmod 700 /tmp/sc-config 2>/dev/null || true
+
+# Auf User wechseln und Python-Skript starten
+exec gosu appuser python /app/scalable_sync.py "$@"