20193 security fixes

Author: Evgeny Shvarov

Dockerfile

@@ -2,23 +2,23 @@ ARG IMAGE=intersystems/iris:2019.1.0S.111.0
 ARG IMAGE=store/intersystems/iris:2019.1.0.511.0-community
 ARG IMAGE=store/intersystems/iris:2019.2.0.107.0-community
 #ARG IMAGE=intersystems/iris:2019.3.0.302.0
-#ARG IMAGE=store/intersystems/iris:2019.3.0.302.0-community
+ARG IMAGE=store/intersystems/iris:2019.3.0.302.0-community
 FROM $IMAGE
 
+USER root
+
 WORKDIR /opt/app
+RUN chown irisowner /opt/app
+
+USER irisowner
 
-COPY ./Installer.cls ./
-COPY ./src/cls ./src/cls
-#COPY ./src/dfi ./src/dfi
+COPY  ./Installer.cls ./
+COPY  ./src/cls ./src/cls
+#COPY --chown=irisowner ./src/dfi ./src/dfi
 
 
 RUN iris start $ISC_PACKAGE_INSTANCENAME quietly EmergencyId=sys,sys && \
     /bin/echo -e "sys\nsys\n" \
-            " Do ##class(Security.Users).UnExpireUserPasswords(\"*\")\n" \
-            " Do ##class(Security.Users).AddRoles(\"admin\", \"%ALL\")\n" \
-            " Do ##class(Security.System).Get(,.p)\n" \
-            " Set p(\"AutheEnabled\")=\$zb(p(\"AutheEnabled\"),16,7)\n" \
-            " Do ##class(Security.System).Modify(,.p)\n" \
             " Do \$system.OBJ.Load(\"/opt/app/Installer.cls\",\"ck\")\n" \
             " Set sc = ##class(App.Installer).setup(, 3)\n" \
             " If 'sc do \$zu(4, \$JOB, 1)\n" \

Dockerfile-20193

@@ -5,12 +5,17 @@ ARG IMAGE=store/intersystems/iris:2019.2.0.107.0-community
 ARG IMAGE=store/intersystems/iris:2019.3.0.302.0-community
 FROM $IMAGE
 
+USER root
+
 WORKDIR /opt/app
+RUN chown irisowner /opt/app
+
+USER irisowner
+
+COPY  ./Installer.cls ./
+COPY  ./src/cls ./src/cls
+#COPY --chown=irisowner ./src/dfi ./src/dfi
 
-COPY ./Installer.cls ./
-COPY ./src/cls ./src/cls
-#COPY ./src/dfi ./src/dfi
-USER root
 
 RUN iris start $ISC_PACKAGE_INSTANCENAME quietly EmergencyId=sys,sys && \
     /bin/echo -e "sys\nsys\n" \
@@ -22,5 +27,4 @@ RUN iris start $ISC_PACKAGE_INSTANCENAME quietly EmergencyId=sys,sys && \
     /bin/echo -e "sys\nsys\n" \
     | iris stop $ISC_PACKAGE_INSTANCENAME quietly
 
-USER ${ISC_PACKAGE_MGRUSER}
 CMD [ "-l", "/usr/irissys/mgr/messages.log" ]