feat(permissions): create user owned directory for DB in container (#41)

Creates a new directory /data inside the docker container to store the grype DB, this directory is chowned to the docker user 1000 to make sure that the container can run without a volume mount.

Dockerfile

@@ -23,9 +23,16 @@ WORKDIR /app
 
 COPY --from=builder ["/build/grype-server/grype-server", "./grype-server"]
 
+ENV DB_ROOT_DIR=/data
+
+RUN mkdir -p $DB_ROOT_DIR \
+    && chown 1000:1000 $DB_ROOT_DIR
+
+USER 1000:1000
+
 ENTRYPOINT ["/app/grype-server"]
 
-USER 1000
+CMD ["run"]
 
 # Build-time metadata as defined at http://label-schema.org
 ARG BUILD_DATE

grype-server/cmd/grype-server/main.go

@@ -73,7 +73,7 @@ func run(c *cli.Context) {
 func main() {
 	viper.SetDefault(config.RestServerPort, "9991")
 	viper.SetDefault(config.HealthCheckAddress, ":8080")
-	viper.SetDefault(config.DbRootDir, "/app/")
+	viper.SetDefault(config.DbRootDir, "./")
 	viper.SetDefault(config.DbUpdateURL, "https://toolbox-data.anchore.io/grype/databases/listing.json")
 	viper.AutomaticEnv()