NUTCH-3213 Harden Docker image: non-root USER and Dockerfile lint (SonarCloud)

[lewismc]

Fixes NUTCH-3213 which provides a comprehensive description of the proposed improvements.

[github-actions]

Apache Yetus test-patch report

+1 overall

Vote	Subsystem	Runtime	Log	Comment
				Prechecks
+1	dupname	0m 0s		No case conflicting files found.
+1	@author	0m 0s		The patch does not contain any @author tags.
				master Compile Tests
				Patch Compile Tests
+1	codespell	0m 2s		No new issues.
+1	detsecrets	0m 31s		No new issues.
+1	blanks	0m 0s		The patch has no blanks issues.
+1	hadolint	0m 0s		The patch generated 0 new + 0 unchanged - 9 fixed = 0 total (was 9)
+1	markdownlint	0m 1s		The patch generated 0 new + 4 unchanged - 2 fixed = 4 total (was 6)
+1	shellcheck	0m 0s		No new issues.
+1	shelldocs	0m 0s		No new issues.
+1	yamllint	0m 0s		No new issues.
				Other Tests
+1	asflicense	0m 1s		The patch does not generate ASF License warnings.
		0m 40s

Subsystem	Report/Notes
GITHUB PR	#968
Optional Tests	dupname asflicense codespell detsecrets hadolint shellcheck shelldocs markdownlint yamllint
uname	Linux 6c7682d329bb 6.17.0-1022-azure #22-Ubuntu SMP Mon Jul 27 17:24:03 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	nobuild
Personality	/github/workspace/.yetus/personality.sh
git revision	master / e7cc894
modules	C: . U: .
versions	git=2.34.1 hadolint=2.12.0 codespell=2.4.1 detsecrets=1.5.0 markdownlint=0.44.0 shellcheck=0.10.0 yamllint=1.35.1
Powered by	Apache Yetus 0.15.1 https://yetus.apache.org

This message was automatically generated.

[lewismc]

I added a simple Docker image smoke. PRs (and master pushes) that touch docker/Dockerfile or .github/workflows/docker-smoke.yml now build the image and:

• confirm the default user is nutch (not root), JAVA_HOME / NUTCH_HOME, and that nutch / crawl are on PATH
• write a seed file for https://nutch.apache.org/ and run inject + readdb -stats (expect at least one URL)

There is no generate/fetch. The Dockerfile still clones GitHub master inside the image (same as Hub today), so this checks the image recipe, not this PR’s Java sources.

Ran the same steps locally against the working-tree Dockerfile: inject reported TOTAL urls: 1. Bare nutch exits 1 (usage only), so the workflow uses command -v nutch / crawl instead.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
58.5% Coverage on New Code
1.4% Duplication on New Code

See analysis details on SonarQube Cloud

[lewismc]

/smoke-test