refactor: finalize MkDocs Docker wrapper (#261)

* refactor: finalize MkDocs Docker wrapper

* refactor: finalize MkDocs Docker wrapper

Author: Djaytan

docs/user-guide/Dockerfile

@@ -1,24 +1,32 @@
 # syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7
 # check=error=true
 
+# BusyBox command help: https://www.busybox.net/downloads/BusyBox.html
 FROM docker.io/python:3.13.14-alpine@sha256:b4d299311845147e7e47c970566906caf8378a1f04e5d3de65b5f2e834f8e3bf
 
-WORKDIR /run
+# Setup prerequisites for MkDocs Git-related features (e.g. revisions, collaborators, ...)
+RUN apk add --no-cache git
+
+# Trust mounted host files in container at runtime
+RUN git config --system --add safe.directory /run
+
+# New user and group for MkDocs
+RUN addgroup -S -g 1000 mkdocs && \
+    adduser -S -u 1000 -G mkdocs mkdocs
+
+USER 1000:1000
+
+ENV HOME=/home/mkdocs
+ENV PATH="${PATH}:${HOME}/.local/bin"
+
+WORKDIR ${HOME}
 
 COPY requirements/requirements.txt .
 
-RUN \
-  ## Install MkDocs and its dependencies
-    pip install --no-cache-dir --require-hashes --requirement requirements.txt \
-  && \
-    rm requirements.txt \
-  ## Setup prerequisites for MkDocs Git-related features (e.g. revisions, collaborators, ...)
-  && \
-    apk add --no-cache git \
-  && \
-    git config --system --add safe.directory /run
-
-USER daemon
+# Install MkDocs and its dependencies
+RUN pip install --user --require-hashes --requirement requirements.txt && rm requirements.txt
+
+WORKDIR /run
 
 EXPOSE 8000
 

docs/user-guide/mkdocs.sh

@@ -20,6 +20,7 @@ case "$(uname)" in
     ;;
 esac
 
+# Constraint: MkDocs' Git plugin requires access to the Git history.
 ROOT_PROJECT_DIR="${SCRIPT_DIR}/../.."
 
 echo 'Building Docker image for MkDocs (can take up to a minute)'
@@ -30,7 +31,7 @@ GITHUB_TOKEN="${GITHUB_TOKEN:-$(gh auth token)}"
 
 echo
 echo 'Running MkDocs:'
-# Avoid permission issues by running the container with the current user ID and group ID
+# Avoid permission issues by running the container with the current user ID and group ID.
 docker run --rm -p 8000:8000 --name docker-papermc-server-mkdocs \
   --user "$(id -u):$(id -g)" \
   --mount type=bind,source="${ROOT_PROJECT_DIR}",target=/run \