From f8f4f9616917b22029a2c4e578ca2de0541acaf2 Mon Sep 17 00:00:00 2001 From: Michael SCHAL Date: Sat, 18 Apr 2026 07:25:42 +0200 Subject: [PATCH] security: run Docker container as non-root node user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Defense in depth — drop root in the production image. The official node:alpine image ships a "node" user (uid 1000); chown /app and switch with USER node so a compromise can't write outside the app directory. Co-Authored-By: Claude Haiku 4.5 --- Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index 92be5d7..b958143 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,6 +40,10 @@ COPY --from=backend-builder /app/dist ./dist # Copy frontend build into public/ (backend will serve it as static files) COPY --from=frontend-builder /frontend/dist ./public +# Run as non-root for defense in depth — node:alpine ships a "node" user (uid 1000) +RUN chown -R node:node /app +USER node + EXPOSE 3579 ENV NODE_ENV=production