Run the containers without root

[jmaddencom]

This should improve potential exposure quite a bit by only requiring root in a busybox init container to set the directories up.

Since I've only changed the production configs this won't work alongside a dev install if you're switching between the two. Let me know if you consider this worthwhile and I'll get that working too.

[damianmoore]

Thanks for this contribution @jmaddencom. I'd been meaning to look and this for a while but hadn't got round to it. Couple of points...

• How did you decide on the user IDs to use? I assume 70 and 999 are the ones that the third-party containers are already using.
• Yes please carry out the changes to dev environment if you can - it would be good to have them as close as possible to each other.
• Could you explain the need for the depends_on: init you added please in the compose file?
• I'm intending to use cron more for parts of the background processing soon (to save memory etc.). Would you be able to add that back if you think it would still work with your approach?

Thanks again, and looking forward to merging this in.

[jmaddencom]

Sure thing @damianmoore, will do.

• User ids were somewhat arbitrary, I wanted to provide some defaults that seemed logical and debian-based distributions start at 1000 for non-system users. (Ubuntu anyway, I think that's a debian thing.)
• depends_on ensures init happens before the other containers come up.
• I tried to get cron to work as non-root but failed. (There are some setuid stackoverflows/etc out there but that felt like it wasn't really fixing the issue.) It's kind of counter to the principal of containerization that the container runs a single process...I'll take another stab at it though.

Edit: Right, 70 and 999 are the ones shipped by the containers. At least in the pgsql case I found that difficult to change and probably not worth it as long as it isn't 0.

[jmaddencom]

This updates docs and dev files (but doesn't remove cron from dev, which means cron won't run properly there.) I'll take another swing at non-root cron asap but I've run out of weekend. :/