Setup docker to use php-fpm + Laravel + supervisor in one container - php

Question

I need to have supervisor for my laravel queues. But supervisor starts from root user, and I want to start php from another user for safety. I could not find solution to start php in another way, like a standart user from image - www-data.
And I also have files with backend owner. I read that it's safer to have php files with one owner and start php-fpm with another
Question: is it normal to work in producation with www-data user for php-fpm or I have to have another user for it. Or maybe I can unite php-fpm with supervisor(and cron in future) in another way? And if I have to change user how to start php with another user?
Dockerfile
FROM php:8.1-fpm
# Copy composer.lock and composer.json
COPY composer.lock composer.json /var/www/
# Set working directory
WORKDIR /var/www
# Install system dependencies
RUN apt-get update && apt-get install -y \
build-essential \
git \
curl \
libpng-dev \
libjpeg62-turbo-dev \
libfreetype6-dev \
locales \
libonig-dev \
libxml2-dev \
zip \
jpegoptim optipng pngquant gifsicle \
vim \
unzip \
libpq-dev \
zlib1g-dev \
libzip-dev \
supervisor \
sudo
# Clear cache
RUN apt-get clean && rm -rf /var/lib/apt/lists/*
RUN pecl install -o -f redis \
&& rm -rf /tmp/pear \
&& docker-php-ext-enable redis
# Install PHP extensions
RUN docker-php-ext-install intl pdo pdo_pgsql pgsql mbstring exif pcntl bcmath gd zip
# Get latest Composer
COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
# Add user for laravel application
RUN groupadd -g 1000 backend
RUN useradd -u 1000 -ms /bin/bash -g backend backend
# Copy existing application directory contents
COPY . /var/www
# Copy existing application directory permissions
COPY --chown=backend:backend . /var/www
RUN ["chmod", "+x", "./my_wrapper_script.sh"]
RUN ["chown", "-R", "www-data:www-data", "./storage/framework"]
RUN ["chown", "-R", "www-data:www-data", "./storage/logs"]
COPY --chown=root:root docker-compose/app/supervisor.conf /etc/supervisor/conf.d/supervisord.conf
# Expose port 9000 and start php-fpm server
EXPOSE 9000
CMD ./my_wrapper_script.sh
Docker-compose
version: 3.7
services:
app:
build:
context: ./
dockerfile: Dockerfile
image: didido
container_name: didido-app
restart: unless-stopped
working_dir: /var/www/
tty: true
environment:
SERVICE_NAME: app
SERVICE_TAGS: dev
volumes:
- ./:/var/www
networks:
- didido
db:
image: postgis/postgis:14-3.1
restart: always
container_name: didido-db
networks:
- didido
environment:
- POSTGRES_DB=${DB_DATABASE}
- POSTGRES_USER=${DB_USERNAME}
- POSTGRES_PASSWORD=${DB_PASSWORD}
volumes:
- ../2. Init Database:/docker-entrypoint-initdb.d
- ./data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres -d didido"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
nginx:
image: nginx:1.17-alpine
container_name: didido-nginx
restart: unless-stopped
tty: true
ports:
- 80:80
depends_on:
- nodejs
volumes:
- ./:/var/www
- ./docker-compose/nginx:/etc/nginx/conf.d
networks:
- didido
networks:
didido:
driver: bridge
my_wrapper_script.sh
#!/bin/bash
# Start the first process
php-fpm &
# Start the second process
supervisord &
# Wait for any process to exit
wait -n
# Exit with status of process that exited first
exit $?