Containerfile: ensure that HOME can be used by any user ID

[kpouget]

OpenShift Pods can't use the cache otherwise

Resolves: 600

---

• "I certify that all code in this PR is my own, except as noted below."

Use of AI

• Includes AI-assisted code completion
• Includes code generated by an AI application
• Includes AI-generated tests (NOTE: AI written tests should have a docstring that includes ## WRITTEN BY AI ##)

[dbutenhof]

I think I find the "can be used by any user" a bit misleading since this assumes we're running in GID 0 (setting $HOME group to 0 and copying user mode bits to group). That covers both the OpenShift and standalone container use cases, but the wording suggests something more universal. I think it's "interesting" that you're copying user mode bits rather than just assigning something "known good" like g=rwX; although it's probably safe to assume that the $HOME user mode bits are good by default ...

[kpouget]

the command and comment (s/any/arbitrary) comes from OpenShift documentation:

Support arbitrary user ids

By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node.
For an image to support running as an arbitrary user, directories and files that are written to by processes in the image must be owned by the root group and be read/writable by that group. Files to be executed must also have group execute permissions.
Adding the following to your Dockerfile sets the directory and file permissions to allow users in the root group to access them in the built image:

[dbutenhof]

the command and comment (s/any/arbitrary) comes from OpenShift documentation:

Support arbitrary user ids

Huh. Well, "arbitrary user in group 0", anyway; but if that's a quote from the documentation I guess I can't complain to you. 😆