[FEATURE] Allow docker image to run as non-root

[nebula-it]

Is your feature request related to a problem? Please describe.

The current distroless image is not able to run as non-root user. Here is the config I tried in k8s:

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

Describe the solution you'd like.

Docker images should be able to run as non-root user.

Describe alternatives you've considered.

None

Additional context

No response

Human Written Confirmation

• I confirm this request was written by me and not generated by an LLM or AI assistant.

[steveiliop56]

Hello @nebula-it,

This is (unfortunately) expected behavior. I would ideally like to run both the normal and the distroless image with a non-root user but it would break the Docker ACLs. For example if you bind the Docker socket to a container running with a non-root user, the Docker client on Tinyauth will fail to connect. However in Docker at least you can force a rootless user (with user: 1000:1000), not sure about Kubernetes though.

[nebula-it]

Totally understandable for instances where docker socket is mounted.

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000

in kubernetes is same as setting user: 1000:1000 in docker. However it fails to even startup as db directory is likely not writable by 1000, here is the error log:

2026-06-30T04:32:50Z INF cmd/tinyauth/tinyauth.go:115 > Starting tinyauth log_stream=app version=v5.0.7
{"level":"fatal","error":"command tinyauth error: failed to bootstrap app: failed to setup database: failed to create sqlite3 instance: unable to open database file (14)","time":"2026-06-30T04:32:50Z","message":"Failed to execute command"}

And just for sake of it, I tried running this in docker as well with:

services:
  tinyauth:
    image: ghcr.io/steveiliop56/tinyauth:v5
    restart: unless-stopped
    user: 1000:1000
    environment:
      - TINYAUTH_APPURL=https://tinyauth.example.com
      - TINYAUTH_AUTH_USERS=admin:$$2b$$10$$m.zb47UN7lFxjDtiEFHFZO8wM1APxlmE7cFQpIYHLT0ENrOZUDJNq

and that is failing with same error:

{"level":"fatal","error":"command tinyauth error: failed to bootstrap app: failed to setup database: failed to create sqlite3 instance: unable to open database file (14)","time":"2026-06-30T04:44:39Z","message":"Failed to execute command"}

Do you have the full config that worked with user: 1000:1000 in docker?

[steveiliop56]

Ohh it's probably because the directory in which the database is in is owned by root. Most likely if you add a volume for /data it will work. However using a volume is not a requirement so I will try to fix it in the next release.

[steveiliop56]

Fixed in #959! Using user: 1000:1000 should work in the next version.