FROM robotail/gitea-light-runner:0.2.13

USER root
# OpenSSH resolves the calling UID through /etc/passwd, even when a key and
# remote username are explicit. A numeric Compose user alone is insufficient.
RUN addgroup -g 10001 runner \
    && adduser -D -H -u 10001 -G runner -h /work -s /sbin/nologin runner

USER 10001:10001
WORKDIR /work