Support running the container under a non-root UID

[kmcginnes]

The image runs as uid 0 and declares no USER. Platforms that assign a non-root UID cannot run it. OpenShift does this per namespace, and a Kubernetes runAsNonRoot policy rejects the image outright. Neither is a documented deployment target for us yet, but it is a common constraint and a conventional expectation for a published image.

Ports are not the obstacle. Docker's default net.ipv4.ip_unprivileged_port_start=0 lets an unprivileged UID bind 80 and 443. I confirmed this against public.ecr.aws/neptune/graph-explorer:latest-SNAPSHOT under --user 1001:0.

The obstacle is that startup rewrites the install tree. Running the published image as --user 1001:0:

drwxr-xr-x 1 root root  packages/graph-explorer
drwxr-xr-x 2 root root  packages/graph-explorer-proxy-server/cert-info
-rw-r--r-- 1 root root  packages/graph-explorer/.env

touch: cannot touch 'packages/graph-explorer/.env': Permission denied
touch: cannot touch 'packages/graph-explorer/defaultConnection.json': Permission denied
touch: cannot touch 'cert-info/probe.key': Permission denied

process-environment.sh rewrites .env and generates defaultConnection.json. setup-ssl.sh writes the cert chain into cert-info/. All three targets are root-owned 0755.

Two routes

The conventional container fix is chgrp -R 0 plus chmod -R g=u on the writable paths, then a USER directive. That works with the gid 0 these platforms supply, and could land on its own.

The better route is to stop writing into the install tree, which #1660 already plans through a mounted config file and no cert auto-generation. That is a breaking major, so the permissions route is worth doing first if we want the capability sooner.

Related Issues

• Related to Unified server configuration file #1660, Replace shell scripts with TypeScript server configuration #1670

Important

Internal only — this issue is maintained by the core team and is not accepting external contributions.