From f9e26303d053161d2947e13b7619e004737b6a6c Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Tue, 4 Aug 2026 20:30:17 +0200
Subject: [PATCH] fix: docker container execution user permissions

do not add appuser to docker group (highly insecure) / hardcode GID:UID
---
 roles/docker/tasks/main.yml | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml
index 0f0e5d7..11e0869 100644
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -54,17 +54,6 @@
     enabled: true
   become: true
 
-- name: Create docker user for container execution
-  ansible.builtin.user:
-    name: docker
-    state: present
-    system: true
-    shell: /usr/sbin/nologin
-    groups: docker
-    append: true
-    create_home: false
-  become: true
-
 - name: Add deployment user to docker group
   ansible.builtin.user:
     name: deployment
@@ -72,7 +61,7 @@
     append: true
   become: true
 
-- name: Create target for docker compose
+- name: Create target for docker compose files
   ansible.builtin.file:
     path: /opt/docker
     state: directory
@@ -80,3 +69,21 @@
     group: deployment
     mode: "0755"
   become: true
+
+- name: Create appuser group
+  ansible.builtin.group:
+    name: appuser
+    state: present
+    gid: 9999
+  become: true
+
+- name: Create appuser user for secure container execution
+  ansible.builtin.user:
+    name: appuser
+    state: present
+    uid: 9999
+    group: appuser
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+  become: true