Refactor Dockerfiles for Gitea runners: streamline package installations, remove unnecessary dependencies, and ensure non-root execution

ansible/files/dockerfiles/linux-runners/Dockerfile.cicd-base

@@ -1,31 +1,21 @@
 FROM local/gitea-runner-base:latest
 
-# cicd-base runner profile: common CI build and release tooling.
+# Base image sets USER runner; switch back to root for package installs
 USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	buildah \
-	ca-certificates \
-	curl \
 	fuse-overlayfs \
-	git \
 	iptables \
-	jq \
-	make \
-	openssh-client \
 	podman \
-	python3 \
-	python3-pip \
-	rsync \
 	skopeo \
 	slirp4netns \
 	uidmap \
-	unzip \
-	zip \
 	&& rm -rf /var/lib/apt/lists/*
 
 RUN mkdir -p /etc/containers /var/lib/containers /run/containers && \
 	printf '%s\n' '[storage]' 'driver = "vfs"' > /etc/containers/storage.conf && \
-	printf '%s\n' '[engine]' > /etc/containers/containers.conf
+	printf '%s\n' '[engine]' > /etc/containers/containers.conf && \
+	chown -R 1000:1000 /var/lib/containers
 
 ENV BUILDAH_ISOLATION=chroot
 ENV STORAGE_DRIVER=vfs
@@ -36,3 +26,6 @@ RUN curl -fsSL -o /tmp/trivy.tar.gz \
 	tar -xzf /tmp/trivy.tar.gz -C /tmp && \
 	install -m 0755 /tmp/trivy /usr/local/bin/trivy && \
 	rm -f /tmp/trivy.tar.gz /tmp/trivy
+
+# Default to non-root execution
+USER runner

ansible/files/dockerfiles/linux-runners/Dockerfile.cpp-build

@@ -1,19 +1,11 @@
 FROM local/gitea-runner-base:latest
 
-# cpp-build runner profile: dedicated C/C++ build environment.
+# Base image sets USER runner; switch back to root for package installs
 USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	build-essential \
-	ca-certificates \
 	cmake \
-	curl \
-	git \
-	jq \
-	make \
-	openssh-client \
-	python3 \
-	python3-pip \
-	rsync \
-	unzip \
-	zip \
 	&& rm -rf /var/lib/apt/lists/*
+
+# Default to non-root execution
+USER runner

ansible/files/dockerfiles/linux-runners/Dockerfile.gitea-runner-base

@@ -10,14 +10,29 @@ RUN chmod +x /usr/local/bin/run.sh
 
 ENTRYPOINT ["/usr/local/bin/run.sh"]
 
+# Create dedicated runner user (UID 1000) for non-root container execution
+RUN groupadd -g 1000 runner && \
+    useradd -u 1000 -g 1000 -m -d /home/runner -s /bin/bash runner
+
+# Install runner tooling
 RUN apt-get update && apt-get install -y --no-install-recommends \
     bash \
     ca-certificates \
     curl \
     git \
     jq \
+    make \
     nodejs \
     openssh-client \
+    python3 \
+    python3-pip \
+    rsync \
     unzip \
     zip \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
+
+# Set work directory
+ENV RUNNER_WORKDIR=/home/runner
+
+# Ensure container runs as non-root by default
+USER runner

ansible/files/dockerfiles/linux-runners/Dockerfile.go-build

@@ -1,18 +1,10 @@
 FROM local/gitea-runner-base:latest
 
-# go-build runner profile: dedicated Go build environment.
+# Base image sets USER runner; switch back to root for package installs
 USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
-	ca-certificates \
-	curl \
-	git \
 	golang-go \
-	jq \
-	make \
-	openssh-client \
-	python3 \
-	python3-pip \
-	rsync \
-	unzip \
-	zip \
 	&& rm -rf /var/lib/apt/lists/*
+
+# Default to non-root execution
+USER runner