From fb4292f309d3794ccc838bca295851403f30b72e Mon Sep 17 00:00:00 2001
From: Samuel Gaist <samuel.gaist@idiap.ch>
Date: Thu, 5 Jun 2025 11:27:25 +0200
Subject: [PATCH] feat(docker): build and publish unprivileged Docker image

Similar to swagger-editor

This will allow to deploy Swagger-UI on clusters such as
OpenShift without having to meddle with the security
context and security context constraints.
---
 .github/workflows/docker-build-push.yml | 14 +++++++--
 Dockerfile.unprivileged                 | 42 +++++++++++++++++++++++++
 docs/development/docker.md              | 21 +++++++++++++
 3 files changed, 74 insertions(+), 3 deletions(-)
 create mode 100644 Dockerfile.unprivileged
 create mode 100644 docs/development/docker.md

diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 84d7aefa70a..7b78643f625 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -11,9 +11,16 @@ jobs:
 
   build-push:
     if: github.event.workflow_run.conclusion == 'success'
-    name: Build & Push SwaggerUI Docker image
+    name: Build & Push SwaggerUI Docker images (normal + unprivileged)
     runs-on: ubuntu-latest
-
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - file: Dockerfile
+            tags: swaggerapi/swagger-ui:latest,swaggerapi/swagger-ui:v
+          - file: Dockerfile.unprivileged
+            tags: swaggerapi/swagger-ui-unprivileged:latest,swaggerapi/swagger-ui-unprivileged:v
     steps:
       - uses: actions/checkout@v7
 
@@ -71,7 +78,8 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          file: ${{ matrix.file }}
+          tags: ${{ matrix.tags }}${{ env.RELEASED_VERSION }}
           push: true
           platforms: linux/amd64,linux/arm/v6,linux/arm64,linux/386,linux/ppc64le
           provenance: false
-          tags: swaggerapi/swagger-ui:latest,swaggerapi/swagger-ui:v${{ env.RELEASED_VERSION }}
diff --git a/Dockerfile.unprivileged b/Dockerfile.unprivileged
new file mode 100644
index 00000000000..16b6904fc08
--- /dev/null
+++ b/Dockerfile.unprivileged
@@ -0,0 +1,42 @@
+# Looking for information on environment variables?
+# We don't declare them here — take a look at our docs.
+# https://github.com/swagger-api/swagger-ui/blob/master/docs/usage/configuration.md
+
+FROM nginxinc/nginx-unprivileged:1.27.5-alpine
+
+LABEL maintainer="vladimir.gorej@gmail.com" \
+      org.opencontainers.image.authors="vladimir.gorej@gmail.com" \
+      org.opencontainers.image.url="docker.swagger.io/swaggerapi/swagger-ui" \
+      org.opencontainers.image.source="https://github.com/swagger-api/swagger-ui" \
+      org.opencontainers.image.description="SwaggerUI Docker image" \
+      org.opencontainers.image.licenses="Apache-2.0"
+
+USER root
+
+RUN apk add --update-cache --no-cache "nodejs" "libxml2>=2.13.4-r6" "libexpat>=2.7.0-r0" "libxslt>=1.1.42-r2" "xz-libs>=5.6.3-r1" "c-ares>=1.34.5-r0"
+RUN mkdir /etc/nginx/templates && \
+    mkdir /usr/share/nginx/configurator && \
+    # If user is set to a different ID at runtime, html must be writable by them too
+    chown -R nginx:nginx /usr/share/nginx/html && \
+    chmod a+rw /usr/share/nginx/html
+
+USER nginx
+
+LABEL maintainer="char0n"
+
+ENV API_KEY="**None**" \
+    SWAGGER_JSON="/app/swagger.json" \
+    PORT="8080" \
+    PORT_IPV6="" \
+    BASE_URL="/" \
+    SWAGGER_JSON_URL="" \
+    CORS="true" \
+    EMBEDDING="false"
+
+COPY --chmod=0666 ./docker/default.conf.template ./docker/cors.conf ./docker/embedding.conf /etc/nginx/templates/
+
+COPY --chown=nginx --chmod=0666 ./dist/* /usr/share/nginx/html/
+COPY --chmod=0555 ./docker/docker-entrypoint.d/ /docker-entrypoint.d/
+COPY --chown=nginx --chmod=0666 ./docker/configurator /usr/share/nginx/configurator
+
+EXPOSE 8080
diff --git a/docs/development/docker.md b/docs/development/docker.md
new file mode 100644
index 00000000000..0cacdc3c8fd
--- /dev/null
+++ b/docs/development/docker.md
@@ -0,0 +1,21 @@
+# Docker images
+
+## Building locally
+
+**Privileged image**:
+
+```sh
+ $ docker build . -t swaggerapi/swagger-ui:next
+ $ docker run -d -p 8080:8080 swaggerapi/swagger-ui:next
+```
+
+Now open your browser at `http://localhost:8080/`.
+
+**Unprivileged image**:
+
+```sh
+ $ docker build . -f Dockerfile.unprivileged -t swaggerapi/swagger-ui:next-unprivileged
+ $ docker run -d -p 8080:8080 swaggerapi/swagger-ui:next-unprivileged
+```
+
+Now open your browser at `http://localhost:8080/`.