Implement rootless Docker container with enhanced security and preserved TFTP logging

[antonym]

Summary

• Converts docker-netbootxyz container to run all processes as non-root user for enhanced security
• Preserves TFTP logging functionality for PXE boot debugging
• Adds customizable PUID/PGID support for volume permission management

Key Security Improvements

• ✅ All application processes (nginx, webapp, dnsmasq) run as nbxyz user (UID 1000)
• ✅ Privilege dropping using gosu for secure initialization
• ✅ Only supervisord initialization runs as root, then drops privileges
• ✅ Configurable user/group IDs via PUID/PGID environment variables
• ✅ Proper permission management for all service directories

Performance Optimizations

• ✅ Multi-stage Docker build reduces image size and improves caching
• ✅ Optimized package installation and cleanup
• ✅ Better layer organization for faster rebuilds

TFTP Logging Preservation

• ✅ TFTP request logs appear in docker logs output for debugging
• ✅ dnsmasq configured with --log-dhcp --log-queries --log-facility=-
• ✅ Wrapper script ensures proper log forwarding to container stdout
• ✅ Users can monitor PXE boot requests in real-time

Breaking Changes

None - fully backward compatible

Test Plan

• Container builds successfully
• All services start and run as non-root user
• Web interface accessible on ports 80 and 3000
• TFTP server listening on port 69/udp
• TFTP transaction logs visible in docker logs
• PUID/PGID customization works correctly
• Volume permissions handled properly

Files Changed

• Dockerfile - Multi-stage build optimization and security enhancements
• root/init.sh - Dynamic user creation with PUID/PGID support
• root/start.sh - Privilege dropping with gosu
• root/etc/supervisor.conf - Rootless process management
• root/usr/local/bin/dnsmasq-wrapper.sh - TFTP logging wrapper (new file)
• root/defaults/nginx.conf - Non-root nginx configuration

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR enhances container security by converting processes to run as a non-root user while preserving TFTP logging and enabling configurable user/group IDs. Key changes include:

• Converting process execution to use the nbxyz user via gosu in supervisor.conf and start.sh.
• Adding dynamic user creation and permission management with PUID/PGID support in init.sh.
• Optimizing the Dockerfile with a multi-stage build and improved image metadata.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
root/start.sh	Updates to clarify root-level configuration and use exec with supervisord via gosu.
root/init.sh	Adds dynamic user/group creation and configures directory permissions.
root/etc/supervisor.conf	Updates to run services as nbxyz using gosu and configures log forwarding.
README.md	Documents new PUID/PGID options and usage instructions.
Dockerfile	Introduces a multi-stage build with improved dependency installation and metadata.
.dockerignore	Adds standard ignore patterns for build-related files and directories.