From d333d6af4a3e110d87bffae5942e5da331f57970 Mon Sep 17 00:00:00 2001
From: Josh Creek <8179928+jcreek@users.noreply.github.com>
Date: Wed, 25 Feb 2026 21:15:21 +0000
Subject: [PATCH] fix(#5): run container as non-root user

---
 Dockerfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 3253d38..20e0a98 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,12 +22,19 @@ ENV NODE_ENV=production
 ENV HOST=0.0.0.0
 ENV PORT=3000
 
+RUN addgroup -S appuser && adduser -S -G appuser appuser
+
 COPY --from=builder /app/build ./build
 COPY --from=builder /app/server.mjs ./server.mjs
 COPY --from=builder /app/data ./data
 
+RUN chown -R appuser:appuser /app/build /app/server.mjs /app/data /app \
+	&& chmod -R u+rwX /app /app/data
+
 EXPOSE 3000
 
+USER appuser
+
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
 	CMD wget -qO- http://127.0.0.1:3000/ > /dev/null || exit 1