Eh...the usual "FROM: alpine:edge", pull everything in with git, change the code as needed, static compiling everything, strip dead code out of the binary, send the binary in a scratch image and then assigning a non-root user to it.
Eh, I don't have anything "complex" to add, other than buying a raspberry pi and using it as a DNS sinkhole/recursive dns under docker/ipvlan network, and then "hiding" it behind a macvlan connection + ufw. Been doing this over several years and never had any problems with it. You can even use it as a music player of sorts by configuring a hotkey to bring up mpv with a playlist, and another one to close it. Oh, and even as a "live stream player 24/7" if you are into it.
Because I'm doing this as a "self-learning" process. Plus, docker is an excellent tool and even "silly" images like this one can give me an edge while looking for (more) jobs, so there's that. Coding could grant me the same "edge" as well yes, but docker has "more value" since it requires you to code -AND- to have some knowledge/depth regarding typical "dockerization" processes.
I don't really have a "better distro" preference -- all distros can be tweaked and optimized equally, with no benefits from one another. And yes, even Ub(l)untu.
No. ps aux remains the same. And yes, "My sudoer username" is my non-root user with sudo privileges. Therefore, the "sudoer".
And I'm not really "pulling my hair out" because of this, honestly -- just curious if this can be mentioned as a hack, a hack attempt, or whatevertheheck. Because this is the first time in my entire life that this happened with me, so yep.
Alright, first one returned me "bash: alias: nano: not found". Second one, "nano is hashed (/usr/bin/nano)". Third one, my sudoer username. And the fourth one shows my sudoer username at the top of the list, with both uid and gid at 1000.
And I honestly can't really think of much to add, other than the username in the docker image being completely nonexistant (It's just a bunch of numbers, and it doesn't even have a name). I don't know, maybe someone managed to breach the container and gave this "nonexistant user" root privileges but haven't managed to do much or something like that. I'm not that much of a tech savvy, but I guess it doesn't hurt to try to guess something. Maybe there is something inside the container? Idk, I'm gonna (try to) check it out (It's a "distroless" image -- it doesn't even have a shell in it.).
i.e file is created (as non-root), trying to remove the file (once again, as non-root) gives me a "rm: cannot remove 'dir/file.name': Permission denied" error message.
Eh...the usual "FROM: alpine:edge", pull everything in with git, change the code as needed, static compiling everything, strip dead code out of the binary, send the binary in a scratch image and then assigning a non-root user to it.