Fix container to run app as routewatch user

Use runuser to drop privileges and execute the app as the routewatch
user (uid 1000). Fix data directory permissions at runtime since host
mounts may have incorrect ownership.

Dockerfile

@@ -51,15 +51,15 @@ COPY --from=builder /routewatch-source.tar.zst /app/source/routewatch-source.tar
 # Set ownership
 RUN chown -R routewatch:routewatch /app
 
-USER routewatch
-
 ENV XDG_DATA_HOME=/var/lib
 
 # Expose HTTP port
 EXPOSE 8080
 
+COPY ./entrypoint.sh /entrypoint.sh
+
 # Health check using the health endpoint
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -sf http://localhost:8080/.well-known/healthcheck.json || exit 1
 
-ENTRYPOINT ["/app/routewatch"]
+ENTRYPOINT ["/bin/bash", "/entrypoint.sh" ]

entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+cd /var/lib/berlin.sneak.app.routewatch
+chown -R routewatch:routewatch .
+chmod 700 .
+
+exec runuser -u routewatch -- /app/routewatch