sonar
sonar copied to clipboard
Drop permission of gunicorn container
Out of necessity (to access the bluetooth chip), the celery container must run as root. However, this is not true for the (publicly exposed) gunicorn container. We should drop permission of this container to nobody. As part of that, we also need to alter the permission of of the SQLite database (chown nobody:nobody) in order for the gunicorn container to be able to interact with the database.