feat(squid): run container as non-root proxy user

[Copilot]

Squid container previously started as root to fix mounted volume permissions, increasing impact of potential container escapes or Squid vulnerabilities.

Changes

Container security

• Added USER proxy directive to run as non-root (UID 13, GID 13) from container start
• Removed chown/chmod from entrypoint - no longer requires root at any point
• Made /run writable by proxy user in Dockerfile (required for PID file)

Host directory permissions

• Changed SSL database permissions: 0o700 → 0o777 (directories), 0o600 → 0o666 (files)
• Squid logs already created with 0o777 - no changes needed
• Host creates directories world-writable so proxy user can write without privilege escalation

Implementation approach

// SSL database now accessible by non-root proxy user
fs.mkdirSync(sslDbPath, { recursive: true, mode: 0o777 });  // was 0o700
fs.mkdirSync(certsPath, { mode: 0o777 });                   // was 0o700
fs.writeFileSync(indexPath, '', { mode: 0o666 });           // was 0o600

This eliminates root access entirely from the Squid container runtime, reducing attack surface compared to privilege-dropping patterns.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Security] Run Squid container as non-root user</issue_title>
<issue_description>## Priority
Medium

Description

The Squid container currently runs as root initially, which increases the impact of potential container escapes or vulnerabilities in Squid itself.

Impact

• Severity: Medium
• Attack Vector: Squid vulnerability or container escape with root privileges
• Risk: Greater system compromise if Squid is compromised

Proposed Solution

Configure Squid to run as a non-root user from the start:

1. Use USER directive in Dockerfile
2. Ensure proper permissions for Squid directories
3. Update entrypoint script if needed

Effort Estimate

~3 hours

References

• Source: Daily Security Review Discussion [Security Review] Daily Security Review - January 16, 2026 #228
• Location: containers/squid/Dockerfile</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Security] Run Squid container as non-root user #250

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.