contrib: android: Dockerfile: fix build user env
What the developer wrote
Authored by Aaron Fiore
contrib: android: Dockerfile: fix build user env
The previous layers were somewhat senseless; as the buildozer user's
UID and environment must remain static across the entire build.
Resolves: "Usage of undefined variable '$HOME_DIR'"
Refactoring command args also keeps things sane.
What changed, and why it matters
This commit fixes the Android build Dockerfile so the non-root user is created consistently and environment variables like HOME_DIR are defined properly. It removes a previously undefined variable reference that could break the build. There is no direct security vulnerability being patched; it is a build-script cleanup and hardening improvement.
No immediate security action required. Reviewers may verify that UID 1000 aligns with the host/buildozer environment and that the fixed user does not conflict with host expectations. Treat as routine build hygiene.
Security signals we found
Build container user creation hardening
Removal of undefined variable usage in Dockerfile
Deterministic UID/GID alignment with upstream buildozer
Evidence from the diff
The Dockerfile change hardcodes the build user to UID 1000 named ‘user’ with a fixed home directory /home/user, matching buildozer’s expectations. It replaces dynamic UID handling and an undefined HOME_DIR shell variable with explicit ENV declarations. Ownership and USER directives now reference the username instead of a numeric UID. This resolves a build-time error and makes the container environment deterministic.
Changed components
contrib/android/DockerfileInspect captured patch +8 / −9
diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index d462bd4..b1615bb 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -196,17 +196,16 @@ RUN apt -y update -qq \
# create new user to avoid using root; but with sudo access and no password for convenience.
-ARG UID=1000
-RUN if [ "$UID" != "0" ] ; then useradd --uid $UID --create-home --shell /bin/bash "user" ; fi
-RUN usermod -append --groups sudo $(id -nu $UID || echo "user")
+# NOTE: UID *MUST* align with buildozer's Dockerfile "user"
+RUN useradd -u 1000 -m -s /usr/bin/bash -d /home/user user
+RUN usermod -aG sudo user
RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-RUN HOME_DIR=$(getent passwd $UID | cut -d: -f6)
-ENV WORK_DIR="${HOME_DIR}/wspace" \
- PATH="${HOME_DIR}/.local/bin:${PATH}"
+ENV HOME_DIR=/home/user
+ENV WORK_DIR="${HOME_DIR}/wspace"
+ENV PATH="${HOME_DIR}/.local/bin:${PATH}"
WORKDIR ${WORK_DIR}
-RUN chown --recursive ${UID} ${WORK_DIR} ${ANDROID_SDK_HOME}
-RUN chown ${UID} /opt
-USER ${UID}
+RUN chown -R user ${WORK_DIR} ${ANDROID_SDK_HOME} /opt
+USER user
# build cpython. FIXME we can't use the python3 from apt, as it is too new o.O
# - p4a and buildozer require cython<3 (see https://github.com/kivy/python-for-android/issues/2919)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.