From 195f2b3d6287f4a3c12d62adfddcd083a215ea31 Mon Sep 17 00:00:00 2001 From: Henry Date: Sat, 16 May 2026 22:49:51 +0100 Subject: [PATCH] fix: run web container as non-root user (UID 1000) --- apps/web/Dockerfile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile index 84dba9ef..97b2e44d 100644 --- a/apps/web/Dockerfile +++ b/apps/web/Dockerfile @@ -110,13 +110,15 @@ ENV PORT=3000 ENV HOSTNAME=0.0.0.0 # Copy the standalone Next.js server -COPY --from=builder /app/apps/web/.next/standalone/ ./ +COPY --chown=1000:1000 --from=builder /app/apps/web/.next/standalone/ ./ # Copy static assets and public files -COPY --from=builder /app/apps/web/.next/static/ ./apps/web/.next/static/ -COPY --from=builder /app/apps/web/public/ ./apps/web/public/ +COPY --chown=1000:1000 --from=builder /app/apps/web/.next/static/ ./apps/web/.next/static/ +COPY --chown=1000:1000 --from=builder /app/apps/web/public/ ./apps/web/public/ # Copy bootstrap script for runtime env var injection -COPY apps/web/bootstrap.cjs ./bootstrap.cjs +COPY --chown=1000:1000 apps/web/bootstrap.cjs ./bootstrap.cjs + +USER 1000:1000 EXPOSE 3000 CMD ["bootstrap.cjs"]