feat(cli): validator container runs with cartesi unprivileged user

[endersonmaia]

Using the post_start docker compose hook, we can create the snapshot directory and copy the snapshot using the root user and start the container with cartesi unprivileged user.

Requires compose plugin 2.30.0

See: https://docs.docker.com/compose/how-tos/lifecycle/

---

This pull request includes several updates to the @cartesi/cli package, focusing on improving security and updating dependencies. The most important changes include running the validator container with an unprivileged user and updating the minimum required Docker Compose version.

Security improvements:

• apps/cli/src/node/docker-compose-validator.yaml: Modified the services section to run the validator container with the cartesi unprivileged user instead of root.

Dependency updates:

• apps/cli/src/commands/doctor.ts: Updated the minimum required Docker Compose version to 2.30.0.

Documentation:

• .changeset/seven-seals-pull.md: Added a changeset entry to document the update to run the validator container with the cartesi unprivileged user.

[changeset-bot]

🦋 Changeset detected

Latest commit: 61ab946

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cartesi/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report for ./apps/cli

Status	Category	Percentage	Covered / Total
🔵	Lines	31%	293 / 945
🔵	Statements	31.13%	298 / 957
🔵	Functions	36.95%	51 / 138
🔵	Branches	27.88%	121 / 434

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
apps/cli/src/commands/doctor.ts	0%	0%	0%	0%	6-137

Generated in workflow #268 for commit 61ab946 by the Vitest Coverage Report Action

[tuler]

This busy wait and coordination between the command and post_start is not very elegant.
Does it really need to be this way? What if the post_start fails for whatever reason?

[endersonmaia]

We could add some timeout to ensure it fails.

Does it really need to be this way?

It's my approach to run the validator with an unprivileged user leveraging compose.

There are other approaches, for sure, would have to test some alternatives.

[tuler]

How about we first see how the start + deploy would work. Because it will be different in that case.

[endersonmaia]

sure, we can put this on-hold

if the rollups-node container image release already has this in-place, this process or preparing a directory should just be unnecessary

[tuler]

In any case, if we move forward with a system-wide cartesi start we will need to revisit how the node get access to the cartesi machine of a specific project.

[tuler]

Is there still a reason for this PR?

[endersonmaia]

Is there still a reason for this PR?

No, since rollups-node doesn't have a container image release anymore.

Se could aim to run all services with unorivileged users, on another PR.