[Backport 8.3] non-root user to build artifacts inside the container

.ci/Dockerfile

@@ -1,12 +1,25 @@
 ARG PYTHON_VERSION=3.8
 FROM python:${PYTHON_VERSION}
 
+# Default UID/GID to 1000
+# it can be overridden at build time
+ARG BUILDER_UID=1000
+ARG BUILDER_GID=1000
+ENV BUILDER_USER elastic
+ENV BUILDER_GROUP elastic
+
+# Create user
+RUN groupadd --system -g ${BUILDER_GID} ${BUILDER_GROUP} \
+    && useradd --system --shell /bin/bash -u ${BUILDER_UID} -g ${BUILDER_GROUP} -d /var/lib/elastic -m elastic 1>/dev/null 2>/dev/null \
+    && mkdir -p /code/elasticsearch-py && mkdir /code/elasticsearch-py/build \
+    && chown -R ${BUILDER_USER}:${BUILDER_GROUP} /code/elasticsearch-py
+COPY --chown=$BUILDER_USER:$BUILDER_GROUP . .
 WORKDIR /code/elasticsearch-py
+USER ${BUILDER_USER}:${BUILDER_GROUP}
 COPY dev-requirements.txt .
 RUN python -m pip install \
     -U --no-cache-dir \
     --disable-pip-version-check \
     nox -rdev-requirements.txt
-
-COPY . .
-RUN python -m pip install -e .
+COPY --chown=$BUILDER_USER:$BUILDER_GROUP . .
+RUN python -m pip install -U -e .

.ci/make.sh

@@ -115,6 +115,7 @@ esac
 echo -e "\033[34;1mINFO: building $product container\033[0m"
 
 docker build \
+  --build-arg BUILDER_UID="$(id -u)" \
   --file $repo/.ci/Dockerfile \
   --tag ${product} \
   .
@@ -129,6 +130,7 @@ if [[ "$CMD" == "assemble" ]]; then
 
   # Build dists into .ci/output
   docker run \
+     -u "$(id -u)" \
     --rm -v $repo/.ci/output:/code/elasticsearch-py/dist \
     $product \
     /bin/bash -c "python /code/elasticsearch-py/utils/build-dists.py $VERSION"

.ci/run-elasticsearch.sh

@@ -116,6 +116,7 @@ END
   echo -e "\033[34;1mINFO:\033[0m Starting container $node_name \033[0m"
   set -x
   docker run \
+    -u "$(id -u)" \
     --name "$node_name" \
     --network "$network_name" \
     --env "ES_JAVA_OPTS=-Xms1g -Xmx1g -da:org.elasticsearch.xpack.ccr.index.engine.FollowingEngineAssertions" \

.ci/run-repository.sh

@@ -33,6 +33,7 @@ echo -e "\033[1m>>>>> Run [elastic/elasticsearch-py container] >>>>>>>>>>>>>>>>>
 
 mkdir -p junit
 docker run \
+  -u "$(id -u)" \
   --network=${network_name} \
   --env "STACK_VERSION=${STACK_VERSION}" \
   --env "ELASTICSEARCH_URL=${elasticsearch_url}" \