Run script in conatiner as unrivileged user.

docker/entrypoint.sh

@@ -4,9 +4,31 @@ set -eu
 
 SCHEDULE="${SCHEDULE:-* * * * *}"
 CRON_LOG_LEVEL="${CRON_LOG_LEVEL:-2}"
+PUID="${PUID:-1000}"
+PGID="${PGID:-1000}"
 CRON_FILE="/etc/crontabs/root"
 
-printf '%s /usr/local/bin/nsupdate.sh\n' "${SCHEDULE}" > "${CRON_FILE}"
+# Create or update group with specified PGID
+if grep -q "^nsupdate:" /etc/group 2>/dev/null; then
+  delgroup nsupdate 2>/dev/null || true
+fi
+addgroup -g "${PGID}" nsupdate 2>/dev/null || true
+
+# Create or update user with specified PUID
+if grep -q "^nsupdate:" /etc/passwd 2>/dev/null; then
+  deluser nsupdate 2>/dev/null || true
+fi
+adduser -u "${PUID}" -G nsupdate -s /sbin/nologin -D nsupdate 2>/dev/null || true
+
+# Set ownership of volumes
+chown -R "${PUID}:${PGID}" /config /log
+
+# Ensure crontabs directory exists
+mkdir -p "$(dirname "${CRON_FILE}")"
+
+# Write cron job to run as the specified user (by UID:GID)
+printf '%s su -s /bin/sh %s:%s -c /usr/local/bin/nsupdate.sh\n' "${SCHEDULE}" "${PUID}" "${PGID}" > "${CRON_FILE}"
+chmod 600 "${CRON_FILE}"
 
 if [ "$#" -gt 0 ]; then
 	if [ "$1" = "crond" ]; then