fix: permission denied in the docker image

[nodece]

Fix #4461

Motivation

$BK_USER has been added to the image, we should use this user to run the image.

You can try this command to verify this PR.

gh pr checkout 4464
cd docker
docker build -t zixuan/bk .
docker run -it --rm zixuan/bk

Changes

• Use $BK_USER with the group root to run the image.
• Follow up "Principle of least privilege".
• Add ZK_SHELL_HOME to set the zk-shell home to writing .zk-shell file to BK_HOME/data, not BK_HOME.

[nodece]

Could you help to review this PR? @shoothzj

[StevenLuMT]

LGTM

[nodece]

Bump

[shoothzj]

@lhotari Would you please take a look again?

[lhotari]

It's not great that /opt/bookkeeper is required to be writable, but that issue could be handled separately.

[lhotari]

the build should be a multi-staged one. Otherwise chmod/chown operations could increase the resulting image size significantly because changing the ownership or access bits makes a copy of the file.

[nodece]

@lhotari Your review result has been fixed.

[lhotari]

LGTM, good work!