Container as non root and read only

[Noneangel]

Add an env variable ACTUAL_DATA_DIR to customize where the data is written.

User can mount this directory and make the container read only.

Process node is run as node user (uid=1000, gid=1000).

Possible improvement

1. customize the uid/gid of the user during build,
2. add to README that container can be run as user uid/gid.

Close #79

[codecov]

Codecov Report

❌ Patch coverage is 98.68421% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 99.30%. Comparing base (c5d7647) to head (080efae).

Files with missing lines	Patch %	Lines
src/container-security.ts	98.59%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #81      +/-   ##
==========================================
- Coverage   99.52%   99.30%   -0.23%     
==========================================
  Files           5        6       +1     
  Lines         211      286      +75     
  Branches       29       58      +29     
==========================================
+ Hits          210      284      +74     
- Misses          1        2       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Noneangel]

Unfortunately, access is not reliable in my test, and can lead to race condition (source). So error will be cached at writing time.

[Noneangel]

I introduced this env variable in this MR. you could remove it instead of deprecating it.

[seriouslag]

ah yeah, i think we can ignore this and always use /data inside the container
I don't see why we would need to change this. I will look at removing this in this PR.

[Noneangel]

I added ACTUAL_DATA_DIR because I did not want local tests to write to my host computer /data.