contrib: build-{linux,wine}: continue fixing build user env
What the developer wrote
Authored by Aaron Fiore
contrib: build-{linux,wine}: continue fixing build user env
A continuation of 99b0df0f9fdf1d1feb50338091e233d53f9fabc3, as requested
in https://github.com/spesmilo/electrum/pull/10486.
What changed, and why it matters
This commit adjusts the build environment setup in three Dockerfiles used to compile Electrum packages. It removes a configurable user ID argument and hardcodes the build user as UID 1000, matching another build container. The change is a build-hardening/maintenance fix; it does not appear to fix an active software vulnerability in Electrum itself.
No urgent action required. Treat as routine build-maintenance hygiene. Reviewers may verify that UID 1000 does not conflict with host user IDs in your build environment and that the fixed user still has only the intended sudo privileges.
Security signals we found
Build environment hardening (fixed non-root build user)
Removal of configurable UID argument reduces variability but is not a vulnerability fix
No changes to application code, wallet logic, or network protocol
Evidence from the diff
The patch modifies contrib/build-linux/appimage/Dockerfile, contrib/build-linux/sdist/Dockerfile, and contrib/build-wine/Dockerfile. Previously these files accepted an ARG UID=1000, conditionally created a user, and derived HOME_DIR from the password database. The new code unconditionally creates a fixed ‘user’ account with UID 1000, hardcodes HOME_DIR=/home/user, and uses the username (not UID) for chown/USER directives. The commit message frames this as a continuation of an earlier build-user-environment fix requested in a pull request. There is no change to Electrum’s runtime code, cryptographic logic, or network handling.
Changed components
contrib/build-linux/appimage/Dockerfilecontrib/build-linux/sdist/Dockerfilecontrib/build-wine/DockerfileInspect captured patch +24 / −25
diff --git a/contrib/build-linux/appimage/Dockerfile b/contrib/build-linux/appimage/Dockerfile
index 5f43ac9..a20cebb 100644
--- a/contrib/build-linux/appimage/Dockerfile
+++ b/contrib/build-linux/appimage/Dockerfile
@@ -74,13 +74,13 @@ RUN apt-get update -q && \
apt-get clean
# create new user to avoid using root; but with sudo access and no password for convenience.
-ARG UID=1000
-RUN if [ "$UID" != "0" ] ; then useradd --uid $UID --create-home --shell /bin/bash "user" ; fi
-RUN usermod -append --groups sudo $(id -nu $UID || echo "user")
+# NOTE: UID *MUST* align with buildozer's Dockerfile "user"
+RUN useradd -u 1000 -m -s /usr/bin/bash -d /home/user user
+RUN usermod -aG sudo user
RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-RUN HOME_DIR=$(getent passwd $UID | cut -d: -f6)
-ENV WORK_DIR="${HOME_DIR}/wspace" \
- PATH="${HOME_DIR}/.local/bin:${PATH}"
+ENV HOME_DIR=/home/user
+ENV WORK_DIR="${HOME_DIR}/wspace"
+ENV PATH="${HOME_DIR}/.local/bin:${PATH}"
WORKDIR ${WORK_DIR}
-RUN chown --recursive ${UID} ${WORK_DIR}
-USER ${UID}
+RUN chown -R user ${WORK_DIR}
+USER user
diff --git a/contrib/build-linux/sdist/Dockerfile b/contrib/build-linux/sdist/Dockerfile
index 3b6f121..4320eb5 100644
--- a/contrib/build-linux/sdist/Dockerfile
+++ b/contrib/build-linux/sdist/Dockerfile
@@ -17,13 +17,13 @@ RUN apt-get update -q && \
apt-get clean
# create new user to avoid using root; but with sudo access and no password for convenience.
-ARG UID=1000
-RUN if [ "$UID" != "0" ] ; then useradd --uid $UID --create-home --shell /bin/bash "user" ; fi
-RUN usermod -append --groups sudo $(id -nu $UID || echo "user")
+# NOTE: UID *MUST* align with buildozer's Dockerfile "user"
+RUN useradd -u 1000 -m -s /usr/bin/bash -d /home/user user
+RUN usermod -aG sudo user
RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-RUN HOME_DIR=$(getent passwd $UID | cut -d: -f6)
-ENV WORK_DIR="${HOME_DIR}/wspace" \
- PATH="${HOME_DIR}/.local/bin:${PATH}"
+ENV HOME_DIR=/home/user
+ENV WORK_DIR="${HOME_DIR}/wspace"
+ENV PATH="${HOME_DIR}/.local/bin:${PATH}"
WORKDIR ${WORK_DIR}
-RUN chown --recursive ${UID} ${WORK_DIR}
-USER ${UID}
+RUN chown -R user ${WORK_DIR}
+USER user
diff --git a/contrib/build-wine/Dockerfile b/contrib/build-wine/Dockerfile
index 4a7022b..62d2ccd 100644
--- a/contrib/build-wine/Dockerfile
+++ b/contrib/build-wine/Dockerfile
@@ -57,16 +57,15 @@ RUN DEBIAN_CODENAME=$(lsb_release --codename --short) && \
apt-get clean
# create new user to avoid using root; but with sudo access and no password for convenience.
-ARG UID=1000
-RUN if [ "$UID" != "0" ] ; then useradd --uid $UID --create-home --shell /bin/bash "user" ; fi
-RUN usermod -append --groups sudo $(id -nu $UID || echo "user")
+# NOTE: UID *MUST* align with buildozer's Dockerfile "user"
+RUN useradd -u 1000 -m -s /usr/bin/bash -d /home/user user
+RUN usermod -aG sudo user
RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-RUN HOME_DIR=$(getent passwd $UID | cut -d: -f6)
-ENV WORK_DIR="${HOME_DIR}/wspace" \
- PATH="${HOME_DIR}/.local/bin:${PATH}"
+ENV HOME_DIR=/home/user
+ENV WORK_DIR="${HOME_DIR}/wspace"
+ENV PATH="${HOME_DIR}/.local/bin:${PATH}"
WORKDIR ${WORK_DIR}
-RUN chown --recursive ${UID} ${WORK_DIR}
-RUN chown ${UID} /opt
-USER ${UID}
+RUN chown -R user ${WORK_DIR} /opt
+USER user
RUN mkdir --parents "/opt/wine64/drive_c/electrum"
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.