Drop root for nova

Updates to ensure commands run in the nova containers
are done as the 'nova' user rather than root.

Change-Id: I0dd0276c2848ad77d92d350dfa0f20161329ed55
Partially-Implements: blueprint drop-root

docker/nova/nova-api/Dockerfile.j2

@@ -14,3 +14,5 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-api/extend_start.sh

@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    sudo -H -u nova nova-manage db sync
+    nova-manage db sync
     exit 0
 fi

docker/nova/nova-base/Dockerfile.j2

@@ -42,3 +42,5 @@ RUN ln -s nova-base-source/* nova \
     && chown -R nova: /etc/nova /var/log/nova /home/nova
 
 {% endif %}
+
+RUN usermod -a -G kolla nova

docker/nova/nova-compute/Dockerfile.j2

@@ -39,3 +39,5 @@ RUN /var/lib/kolla/venv/bin/pip install --no-cache-dir libvirt-python
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-conductor/Dockerfile.j2

@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-conductor \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-consoleauth/Dockerfile.j2

@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-console \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-libvirt/Dockerfile.j2

@@ -33,3 +33,5 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 755 /usr/local/bin/kolla_extend_start
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-network/Dockerfile.j2

@@ -21,3 +21,5 @@ RUN yum -y install initscripts \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-novncproxy/Dockerfile.j2

@@ -18,3 +18,5 @@ RUN cd /usr/share && ln -s nova-novncproxy-source/* novnc
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-scheduler/Dockerfile.j2

@@ -11,3 +11,5 @@ RUN yum -y install openstack-nova-scheduler \
 {% endif %}
 
 {{ include_footer }}
+
+USER nova

docker/nova/nova-spicehtml5proxy/Dockerfile.j2

@@ -16,3 +16,5 @@ RUN cd /usr/share && ln -s nova-spicehtml5proxy-source/* spice-html5
 {% endif %}
 
 {{ include_footer }}
+
+USER nova