Run vaultwarden unprivileged

Dockerfile

@@ -1,12 +1,24 @@
 ARG VERSION=1.31.0
+ARG UID=3001
+ARG GID=3001
 
 FROM vaultwarden/server:${VERSION}-alpine
 
 LABEL maintainer="Thien Tran [email protected]"
 
+ARG UID
+ARG GID
+
 RUN apk -U upgrade \
     && apk add libstdc++ \
     && rm -rf /var/cache/apk/*
 
 COPY --from=ghcr.io/blue-oci/hardened_malloc:latest /extract /usr/local/lib/
 ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
+
+RUN adduser -g ${GID} -u ${UID} --disabled-password --gecos "" vaultwarden
+RUN chown -R vaultwarden:vaultwarden /data
+USER vaultwarden
+
+ENV ROCKET_PORT=8080
+EXPOSE 8080/tcp

README.md

@@ -4,6 +4,7 @@
 
 ### Features & usage
 - Built on the [official Alpine-based image](https://github.com/dani-garcia/vaultwarden/tree/main/docker), to be used as a drop-in replacement.
+- Unprivileged image: you should check your volumes' permissions (eg `/data`), default UID/GID is 3001. Default port is 8080/tcp.
 - Daily rebuilds keeping the image up-to-date.
 - Comes with the [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) built from the latest tag, protecting against some heap-based buffer overflows.