Implement rootless containers for all services

- backend: appuser UID/GID 1001 via useradd, USER directive, --chown on COPY
- frontend builder: appuser UID/GID 1001 via adduser, USER directive
- frontend prod: switch to nginxinc/nginx-unprivileged:alpine (nginx UID 101), listen on 8080
- docker-compose: explicit user: for all services (70:70 db, 1001:1001 backend/frontend-dev, 101:101 frontend-prod)
- nginx.conf: listen 8080 to match unprivileged image

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

curo1305

2026-04-13 17:18:02 +02:00

parent 3c88e719ed

commit a5baef73d9

7 changed files with 55 additions and 13 deletions

									
										frontend/nginx.conf
									
		+1
		-1
	
												View File
												
				@@ -1,5 +1,5 @@

				server {

				    listen 80;

				    listen 8080;

				    root /usr/share/nginx/html;

				    index index.html;