Update Dockerfile to use unprivileged user (#73)

* Update Dockerfile to create unprivileged user

Use an unprivileged user because Chrome refuses to run as root (unless the sandbox is deactivated which is not the best solution)

* Update docker instructions

The usage of a unprivileged user means we have to add some parameters

Dockerfile

@@ -36,5 +36,7 @@ RUN apt-get -y update &&\
     rm google-chrome-stable_current_amd64.deb 
 
 COPY --from=build-stage /app /app
+RUN adduser --system --group --home /home/app app && chown app:app /app
+USER app
 EXPOSE 7123
 CMD ["/app/snd"]

README.md

@@ -87,8 +87,11 @@ xattr -d com.apple.quarantine "/Applications/Sales & Dungeons.app/"
 
 The headless version of Sales & Dungeons (using LibUSB) is also available via a docker container:
 1. ``docker pull ghcr.io/bigjk/snd:master`` ([container](https://github.com/BigJk/snd/pkgs/container/snd))
-2. ``docker run --expose 7123:7123 --device=/dev/bus/usb -v /some/place/to/persist:/app/userdata ghcr.io/bigjk/snd:master`` (change ``/some/place/to/persist`` to a folder where the user data should be persisted to)
-3. Open ``http://127.0.0.1:7123`` in your favorite browser
+2. ``docker run -p 7123:7123 --device=/dev/bus/usb --group-add uucp -v /some/place/to/persist:/app/userdata ghcr.io/bigjk/snd:master``
+    1. change ``/some/place/to/persist`` to a folder where the user data should be persisted to
+    2. replace `/dev/bus/usb` with the device of your usb/serial printer
+    3. replace `uucp` with a group (or gid) allowed to read the device file (use `$(stat -c "%g" /dev/bus/usb)` to get the right group)
+4. Open ``http://127.0.0.1:7123`` in your favorite browser
 
 <details><summary>Docker Compose Example</summary>
 
@@ -101,6 +104,8 @@ services:
       - "7123:7123"
     devices:
       - "/dev/bus/usb"
+    group_add:
+      - uucp
     volumes:
       - "/some/place/to/persist:/app/userdata"
 ```