pgsesame 0.1.0__tar.gz

pgsesame-0.1.0/.dockerignore

@@ -0,0 +1,10 @@
+.git
+.venv
+.github
+.pytest_cache
+.ruff_cache
+dist
+tests
+examples
+**/__pycache__
+docs/images

pgsesame-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,99 @@
+# Lint, types and tests on every pull request and on main. The PostgreSQL tests
+# run against a real server (a service container); the Redshift tests need
+# oblako's redshift-local and run locally (see tests/test_redshift.py).
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: tests (python ${{ matrix.python }}, postgres ${{ matrix.postgres }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # every PostgreSQL still supported (the access catalogs change between
+        # versions: pg_auth_members in 16, MAINTAIN in 17) on the hooks' Python, and
+        # the oldest and newest Python pyproject.toml allows on one PostgreSQL
+        include:
+          - {python: "3.12", postgres: "14"}
+          - {python: "3.12", postgres: "15"}
+          - {python: "3.12", postgres: "16"}
+          - {python: "3.12", postgres: "17"}
+          - {python: "3.12", postgres: "18"}
+          - {python: "3.10", postgres: "16"}
+          - {python: "3.13", postgres: "16"}
+    services:
+      postgres:
+        image: postgres:${{ matrix.postgres }}
+        env:
+          POSTGRES_USER: sesame
+          POSTGRES_PASSWORD: sesame
+          POSTGRES_DB: sesame
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U sesame" --health-interval 2s
+          --health-timeout 5s --health-retries 30
+    env:
+      PGSESAME_TEST_DSN: postgresql://sesame:sesame@localhost:5432/sesame
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Install the project
+        run: uv sync --locked --python ${{ matrix.python }}
+
+      - name: Hooks (ruff, pydocstyle, ty)
+        if: matrix.python == '3.12' && matrix.postgres == '16'
+        run: uvx prek run --all-files --show-diff-on-failure
+
+      - name: Tests
+        run: uv run pytest -q
+
+  redshift:
+    name: redshift (oblako's redshift-local)
+    runs-on: ubuntu-latest
+    services:
+      redshift:
+        # pinned by digest: :16 moves with every oblako image change. To update,
+        # docker buildx imagetools inspect public.ecr.aws/oblako/redshift-local:16
+        # (oblako d56528d: users, groups, roles and the SVV privilege views)
+        image: public.ecr.aws/oblako/redshift-local:16@sha256:3d2618b23e25ab76d4a2dbfb716f5066e8983d0865182eacec6ea215bb958f8b
+        env:
+          POSTGRES_USER: oblako
+          POSTGRES_PASSWORD: oblako
+          POSTGRES_DB: oblako
+        ports: ["5439:5439"]
+    env:
+      PGSESAME_TEST_REDSHIFT_DSN: host=localhost port=5439 user=oblako password=oblako dbname=oblako sslmode=require
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Install the project
+        run: uv sync --locked
+
+      - name: Wait for redshift-local (the proxy starts after its first-run setup)
+        run: |
+          for i in $(seq 1 90); do
+            uv run python -c "import os, psycopg; psycopg.connect(os.environ['PGSESAME_TEST_REDSHIFT_DSN'], connect_timeout=3).execute('select 1 from svv_roles limit 1')" 2>/dev/null && exit 0
+            sleep 2
+          done
+          echo "redshift-local did not come up"; exit 1
+
+      - name: Redshift tests
+        run: uv run pytest -q tests/test_redshift.py

pgsesame-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,101 @@
+# Publish pgsesame to PyPI when a version tag is pushed (git tag v0.1.0 && git push
+# origin v0.1.0). Trusted publishing: PyPI trusts this workflow through GitHub's
+# OIDC token, so no API token is stored anywhere. The publish job runs in the
+# `pypi` environment, which can require a reviewer's approval before it starts.
+# Then the same version goes to ghcr.io/almostly/pgsesame as a container image.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build and check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: The tag matches the package version
+        run: |
+          version=$(uv run --no-project python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match pyproject.toml version ${version}"
+            exit 1
+          fi
+
+      - name: Build the wheel and the source archive
+        run: uv build
+
+      - name: Check the distributions
+        run: uvx twine check --strict dist/*
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/pgsesame/
+    permissions:
+      id-token: write  # trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  image:
+    name: image to ghcr.io
+    # after PyPI, so an image never carries a version PyPI doesn't have
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # push to ghcr.io with the workflow's own token
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3  # arm64 on an amd64 runner
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Tags (v0.1.0 -> 0.1.0, 0.1, latest) and labels
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+          labels: |
+            org.opencontainers.image.title=pgsesame
+            org.opencontainers.image.description=Permissions as code for PostgreSQL and Amazon Redshift
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

pgsesame-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+.DS_Store
+.tmp/

pgsesame-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,32 @@
+# Hooks for prek (or pre-commit, which reads the same file).
+# Run on demand: uvx prek run --all-files
+# Install the git hooks: uvx prek install --hook-type pre-commit --hook-type commit-msg
+repos:
+  - repo: https://github.com/commitizen-tools/commitizen
+    rev: v4.16.4
+    hooks:
+      - id: commitizen        # validate the message format: Area(+|~|-): description
+        stages: [commit-msg]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.14
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/PyCQA/pydocstyle
+    rev: 6.3.0
+    hooks:
+      - id: pydocstyle
+        files: ^src/pgsesame/.*\.py$
+
+  - repo: local
+    hooks:
+      - id: ty
+        name: ty check
+        # through uv, so ty resolves imports against the project's environment
+        entry: uv run --frozen ty check src tests
+        language: system
+        types: [python]
+        pass_filenames: false

pgsesame-0.1.0/.python-version

@@ -0,0 +1 @@
+3.12

pgsesame-0.1.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Commits follow `Area(<+|~|->): description`, where `+` = **Added**, `~` =
+**Changed**, `-` = **Removed**. Running `cz bump` turns those commits into the
+versioned entries below.
+
+## Unreleased
+
+## v0.1.0 (2026-10-06)
+
+The first release.
+
+### Added
+
+- **CLI**: the `sesame` command (also installed as `pgsesame`, so `uvx pgsesame` works): `sesame validate`, `sesame plan` (Terraform's exit codes: 0 nothing to do, 2 changes, 1 error), `sesame apply`, `sesame show` and `sesame schema`, in pgcli's green
+- **Spec**: principal-centric YAML for roles, users, Redshift groups, memberships, privileges on databases, schemas, tables, views and sequences, ownership and default privileges; parsed into pydantic models with constrained types, every problem reported with its YAML path; a JSON Schema for editors
+- **Plan**: only the spec's principals are managed; `schema.*` expands to the schema's objects; revokes and membership removals are planned but applied only with `--allow-revoke`
+- **Plan**: change sets: `sesame plan -o` saves the plan, `sesame apply changes.json` runs exactly it, or refuses when the database changed in a way that changes the plan, when it was planned against another database, or when its spec was edited
+- **Postgres**: read through the catalog's ACLs; plan and apply in one transaction
+- **Redshift**: users, groups and RBAC roles, read through Redshift's SVV views (no ACL parsing); Redshift's DDL and `GROUP` / `ROLE` grantees
+- **Redshift**: connect with a password, with temporary IAM credentials (`--iam`, a cluster or a Serverless workgroup), or through the Data API (`--data-api`, one transaction per apply)
+- **Release**: on PyPI, and as a container image for CI without Python: `ghcr.io/almostly/pgsesame` (amd64, arm64; tags `0.1.0`, `0.1`, `latest`)
+- **Security**: passwords never go in the spec, a plan, a change set or a log: SecretStr from the environment variable the spec names; the DSN is a SecretStr
+
+Ownership and default privileges are validated but not yet planned.

pgsesame-0.1.0/DESIGN.md

@@ -0,0 +1,272 @@
+# pgsesame design
+
+pgsesame manages database permissions from a YAML file. You declare roles, users,
+groups, memberships, privileges and ownership; `sesame plan` reads what the
+database currently grants, compares it with the file, and prints the SQL that
+would close the difference; `sesame apply` runs it. The workflow follows Terraform:
+the file is reviewed in a pull request, the plan is reviewed before anything runs,
+and a second plan after apply should be empty.
+
+It targets PostgreSQL and Amazon Redshift. They share most of the GRANT
+vocabulary but differ in principals (Redshift has groups next to users and roles),
+in privileges (Redshift adds ALTER, TRUNCATE, DROP and ASSUMEROLE) and in how the
+catalog exposes them, so each engine has its own reader and SQL renderer behind a
+common model.
+
+## Lessons this design starts from
+
+redtape (Redshift) and pgbedrock (PostgreSQL) both did this job and are both
+unmaintained. Running redtape 0.4.2 against a production Redshift cluster showed
+what an access manager has to get right:
+
+- **Read the real catalog without crashing.** redtape's ACL parser rejects
+  privilege letters it does not know (Redshift's `A` and `P`) and the extra columns
+  newer Redshift functions return. pgsesame reads Redshift through its `SVV_*`
+  privilege views, which spell privileges out, and treats anything it does not
+  model as "unmanaged", reported but never fatal.
+- **Diff, do not re-emit.** redtape re-issued every declared grant on every run.
+  pgsesame compares desired and current state as sets keyed by name, so a run
+  issues only the change, and a converged database plans nothing.
+- **Revoke, but only when asked.** A tool that cannot revoke cannot converge; a
+  tool that revokes by default is dangerous. redtape's unfiltered plan contained 46
+  DROP USER/GROUP statements. pgsesame plans revokes and drops but applies them only
+  with explicit flags, and never touches principals outside its scope.
+- **Cover what people actually declare.** Default privileges, ownership and
+  Redshift roles are first-class, not afterthoughts.
+
+## Workflow
+
+```
+spec.yaml ──load + validate──▶ desired state ─┐
+                                              ├─ diff ─▶ plan (ordered SQL) ─▶ apply
+database ──read catalog──────▶ current state ─┘
+```
+
+- `sesame validate spec.yaml`: parse and check the file; no database needed.
+- `sesame plan spec.yaml`: connect, read, diff, print the plan. The exit code
+  follows `terraform plan -detailed-exitcode`: 0 nothing to do, 2 changes planned,
+  1 error, so CI can tell "drift" from "failure".
+- `sesame apply spec.yaml`: plan, then run the plan.
+
+### Change sets
+
+For review before anything runs, as CloudFormation's change sets and
+`terraform plan -out` do: `sesame plan spec.yaml -o changes.json` saves the plan,
+`sesame show changes.json` prints it again without a database, and
+`sesame apply changes.json` runs exactly those statements.
+
+A change set embeds the validated spec (with its SHA-256, so an edited file is
+refused), the target it was planned against (`user@host:db`; applying it anywhere
+else is refused), when it was made, and the typed operations. Apply plans again
+from the embedded spec against the database as it is now and runs the saved
+statements only if the new plan is identical; otherwise it refuses and shows the
+new plan. So a change that matters (a grant made by hand, a new table under
+`schema.*`) stops a stale change set, and a change elsewhere does not. No secret
+is written: a new role's password stays out of the file and is read again from
+its environment variable at apply.
+
+In a pull request: CI runs `sesame plan -o`, the plan is posted for review, and
+the merge job runs `sesame apply` on that file.
+
+## The CLI's look
+
+The command is `sesame`, styled after pgcli: green is the accent colour (the
+header, the `user@host:db` connection line, help headings), and the plan colours
+its operations the way Terraform does: green `+` for creates and grants, red `-`
+for revokes and drops, yellow `~` for changes such as ownership. Colour turns off
+when the output is not a terminal or `NO_COLOR` is set, so CI logs stay plain. An
+interactive `sesame shell` in pgcli's style (prompt_toolkit, completion of
+principal and object names) is a possible later addition, not part of the first
+milestones.
+
+## The spec
+
+Principal-centric, so a reviewer reads one block to see everything a role can do.
+
+```yaml
+version: 1
+engine: redshift            # or postgres
+
+principals:
+  etl:
+    type: user
+    login: true
+    owns:
+      schemas: [analytics]
+
+  analyst:
+    type: role
+    member_of: [reader]
+    privileges:
+      schemas:
+        usage: [analytics, marts]
+      tables:
+        select: [analytics.*, marts.daily_sales]
+
+  reader:
+    type: role
+
+  alice:
+    type: user
+    login: true
+    groups: [analysts]       # Redshift only
+    member_of: [analyst]
+
+  analysts:
+    type: group              # Redshift only
+
+default_privileges:
+  - owner: etl               # objects etl creates ...
+    schema: analytics        # ... in this schema ...
+    grantee: analyst         # ... are readable by analyst
+    tables: [select]
+```
+
+Rules:
+
+- **Principal types**: `role` and `user` on both engines (a PostgreSQL user is a
+  role that can log in); `group` on Redshift only.
+- **Privileges by object type**: `databases`, `schemas`, `tables`, `views`,
+  `sequences` (PostgreSQL), `functions`; each maps privilege names to object
+  patterns. `schema.*` means every existing object of that type in the schema,
+  expanded when the plan is made; future objects are covered by
+  `default_privileges`, as in the database itself.
+- **Ownership** (`owns`) is declared on the owner. Changing it plans
+  `ALTER ... OWNER TO`.
+- **No secrets.** Passwords never appear in the spec. A login user either gets its
+  password from an environment variable named in the spec
+  (`password_env: ALICE_PASSWORD`), authenticates through IAM (Redshift
+  `IAM:` users), or has `password: disabled`.
+- Unknown keys, unknown principals in references and engine-specific keys on the
+  wrong engine are validation errors, reported with the YAML path.
+
+## Scope: what pgsesame manages
+
+The spec's principals are managed. Everything else in the database is **observed
+but untouched**: reported in the plan as unmanaged, never altered. A spec can widen
+its scope with `manage: {prefixes: [app_, svc_]}` to take over principals by name,
+so a team can adopt pgsesame one area at a time. Built-in principals (`PUBLIC`
+aside), superusers, the connecting user and Redshift's `rdsdb` are never managed.
+
+## Reading the current state
+
+**PostgreSQL**: `pg_roles` and `pg_auth_members` for principals and memberships;
+`aclexplode()` over `pg_database`, `pg_namespace`, `pg_class` and `pg_proc` ACLs
+for privileges; `pg_default_acl` for default privileges; object owners from the
+same catalogs.
+
+**Redshift**: `SVV_USER_INFO` and `pg_group` for users and groups,
+`SVV_ROLES`, `SVV_USER_GRANTS` and `SVV_ROLE_GRANTS` for roles and role membership,
+`SVV_RELATION_PRIVILEGES`, `SVV_SCHEMA_PRIVILEGES`, `SVV_DATABASE_PRIVILEGES`,
+`SVV_FUNCTION_PRIVILEGES` and `SVV_DEFAULT_PRIVILEGES` for privileges. These views
+name each privilege, so there is no ACL string to parse. Where a view is missing,
+the reader falls back to ACL strings with a parser that keeps letters it does not
+know as unmanaged privileges.
+
+Both readers return the same model: principals, memberships, a set of
+`(grantee, privilege, object)` triples, owners and default-privilege entries.
+
+## Diff and plan
+
+Desired and current state are compared as sets. Each difference becomes one
+operation (create principal, grant, revoke, add member, change owner, ...), and
+the plan orders them so every statement can succeed: create principals first,
+then ownership, then grants and memberships, then revokes, then drops last.
+Operations render to engine-specific SQL with identifiers quoted on both sides
+(including `IAM:` user names), `PUBLIC` kept as a keyword.
+
+Revokes and drops are always planned and shown, but marked; `apply` runs them only
+with `--allow-revoke` and `--allow-drop`. Without the flags, apply runs the
+additive part and reports what it skipped.
+
+## Applying
+
+PostgreSQL runs the plan in one transaction: all of it or none. Redshift runs it in
+one transaction where its statements allow, and otherwise statement by statement,
+stopping at the first error and reporting what ran. After apply, `sesame plan`
+should be empty; the integration tests assert exactly that.
+
+## Connecting
+
+Connection settings are not part of the spec: the same spec is planned against
+development, staging and production, so where to connect comes from the command
+line or the environment. Redshift speaks PostgreSQL's wire protocol, so a direct
+connection is the same psycopg connection for both engines; only how the
+credentials are obtained differs.
+
+- **Credentials**: `--dsn`, or the standard libpq variables (`PGHOST`, `PGPORT`,
+  `PGDATABASE`, `PGUSER`, `PGPASSWORD`) and `~/.pgpass`. Works for PostgreSQL and
+  for Redshift with a database user's password.
+- **Redshift with IAM** (`pip install "pgsesame[redshift]"`): `--cluster ID` or
+  `--workgroup NAME` with `--iam`. pgsesame asks AWS for temporary database
+  credentials (`GetClusterCredentialsWithIAM` or `GetClusterCredentials` for a
+  provisioned cluster, `redshift-serverless GetCredentials` for a workgroup) with
+  the usual AWS credential chain, then connects directly with them. No password is
+  stored anywhere; the machine still needs a network path to the database.
+- **Redshift Data API** (same extra): `--data-api` with `--cluster ID` or
+  `--workgroup NAME`, authenticated with `--secret-arn` or IAM. Statements go over
+  AWS's HTTPS API, so no network path to the database is needed, which suits CI
+  runners outside the VPC. The Data API runs one statement (or one batch) per call,
+  so apply sends the plan as a batch where Redshift allows it.
+
+All three produce the same connection interface inside pgsesame (run a query,
+run statements), so the reader, planner and applier do not know which one is in
+use, and the integration tests can run the same scenarios over each.
+
+## Implementation choices
+
+- **The spec is pydantic models.** Pydantic checks the structure (types, unknown
+  keys, allowed values); a second pass checks what needs the whole spec
+  (engine-specific privileges, references between principals). Both report every
+  problem with its YAML path. `sesame schema` prints the spec's JSON Schema, so
+  editors can complete and check the YAML as it's written.
+- **Statements are typed objects, not strings.** The planner produces frozen
+  pydantic models (`CreateRole`, `Grant`, `Revoke`, `AddMember`, `AlterOwner`,
+  ...); each renders itself for PostgreSQL or Redshift in one place, and golden
+  tests pin the SQL for both engines.
+- **SQL is composed with `psycopg.sql`** (`SQL`, `Identifier`, `Literal`), so
+  names from the spec are always quoted correctly (`IAM:alice`, mixed case,
+  reserved words) and never concatenated into SQL. The Data API path renders the
+  same objects to text with the same quoting rules.
+- **Catalog queries are named constants**, one module per engine, each covered by
+  the integration tests against a real server.
+- **No SQLAlchemy.** Its Core has no constructs for GRANT, REVOKE, roles, default
+  privileges or ownership, its reflection does not cover roles or ACLs, and it
+  needs a DBAPI driver, which the Data API does not have. It would add weight
+  without removing any SQL. An adapter that accepts a SQLAlchemy engine as a
+  connection can come later if users ask for it.
+
+## Testing
+
+- Unit tests: spec validation, diff and plan ordering, SQL rendering, the ACL
+  fallback parser.
+- Integration tests: `plan`, `apply`, then an empty `plan`, against PostgreSQL in
+  Docker and against oblako's redshift-local. redshift-local does not yet provide the
+  `SVV_*` privilege views; adding them to oblako is a prerequisite for the Redshift
+  integration tests, and also a parity gain for oblako.
+
+## Roadmap
+
+Done in 0.1: the spec and `sesame validate`; plan and apply for roles, users,
+groups, memberships and privileges on PostgreSQL (14 to 18) and Redshift (read
+through its SVV views); change sets; Redshift over IAM credentials and the Data
+API, each tested against oblako and Redshift Serverless.
+
+0.2:
+
+- Ownership (`owns`) and default privileges, planned and applied.
+- Built-in roles a spec can refer to without managing them: Redshift Serverless's
+  `sys:*`, Supabase's `anon`, `authenticated`, `service_role`, AlloyDB's
+  `alloydbsuperuser`, RDS's `rds_superuser`, Cloud SQL's `cloudsqlsuperuser`.
+- Managed PostgreSQL in CI: Supabase (`supabase start`) and AlloyDB Omni, run as
+  the platform's admin role, which is not a superuser there (on PostgreSQL 16+
+  such a role manages only the roles it created).
+- A GitHub Action: plan on a pull request with the plan as a comment, apply the
+  reviewed change set on merge.
+- `manage.prefixes`.
+
+0.3:
+
+- Row-level security: `ENABLE ROW LEVEL SECURITY` and `CREATE POLICY` in the
+  spec, planned and diffed like grants. On Supabase, policies are how data access
+  is controlled, more than grants.

pgsesame-0.1.0/Dockerfile

@@ -0,0 +1,19 @@
+# pgsesame for CI systems without Python: docker run ghcr.io/almostly/pgsesame plan ...
+# Published by .github/workflows/release.yml with each version tag (amd64, arm64).
+FROM python:3.12-slim
+
+COPY --from=ghcr.io/astral-sh/uv:0.10 /uv /usr/local/bin/uv
+
+WORKDIR /src
+COPY pyproject.toml uv.lock README.md LICENSE ./
+COPY src ./src
+# the Redshift extra too (IAM credentials, the Data API): the image is for any target
+RUN uv pip install --system --no-cache ".[redshift]" && rm -rf /src /usr/local/bin/uv
+
+# no root: pgsesame only reads a spec and talks to a database
+RUN useradd --create-home --uid 10001 sesame
+USER sesame
+WORKDIR /work
+
+ENTRYPOINT ["sesame"]
+CMD ["--help"]