From 25f33c292860a4118d5d011809a60273210cf086 Mon Sep 17 00:00:00 2001
From: Moritz Kiefer <moritz.kiefer@purelyfunctional.org>
Date: Fri, 11 Oct 2019 13:03:26 +0200
Subject: [PATCH] Add a `daml` user to docker image and fix PATH (#3160)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, we were installing the SDK as root which is probably not a
good idea. This PR adds a new `daml` user and fixes PATH (`$HOME` and
`~` both don’t work in this context).
---
 ci/docker/daml-sdk/Dockerfile | 4 +++-
 unreleased.rst                | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/ci/docker/daml-sdk/Dockerfile b/ci/docker/daml-sdk/Dockerfile
index b3dce07cf7e..c5b58c519f3 100644
--- a/ci/docker/daml-sdk/Dockerfile
+++ b/ci/docker/daml-sdk/Dockerfile
@@ -1,5 +1,7 @@
 FROM openjdk:8u212-alpine
 RUN apk add curl bash
 ARG VERSION
+RUN addgroup -S daml && adduser -S daml -G daml
+USER daml
 RUN curl https://get.daml.com | sh -s $VERSION
-ENV PATH="~/.daml/bin:${PATH}"
+ENV PATH="/home/daml/.daml/bin:${PATH}"
diff --git a/unreleased.rst b/unreleased.rst
index 3b7e0e60486..739a7e94caf 100644
--- a/unreleased.rst
+++ b/unreleased.rst
@@ -24,3 +24,5 @@ HEAD — ongoing
 + [Scala Codegen] Fixes for StackOverflowErrors in reading large LF archives. See `issue #3104 <https://github.com/digital-asset/daml/issues/3104>`_.
 + [Scala Bindings] Fixed a bug in the retry logic of ``LedgerClientBinding#retryingConfirmedCommands``. Commands are now only retried when the server responds with status ``RESOURCE_EXHAUSTED`` or ``UNAVAILABLE``.
 
++ [DAML-SDK Docker Image] The image now contains a ``daml`` user and the SDK is installed to ``/home/daml/.daml``.
+  ``/home/daml/.daml/bin`` is automatically added to ``PATH``.