# 2026-04-13 — Rootless containers

**Timestamp:** 2026-04-13T00:00:00

## Summary

All containers now run as non-root users with explicit UID:GID assignments enforced in both Dockerfiles and docker-compose files.

## User mapping

| Service | User | UID:GID | Notes |
|---|---|---|---|
| `db` | `postgres` | `70:70` | Fixed by `postgres:16-alpine`; image owns PGDATA as 70:70 so named-volume seeding works |
| `backend` | `appuser` | `1001:1001` | Created via `useradd` in runtime stage |
| `frontend` (prod) | `nginx` | `101:101` | Switched to `nginxinc/nginx-unprivileged:alpine`; listens on 8080 |
| `frontend` (dev) | `appuser` | `1001:1001` | Created via `adduser` in builder stage |

## Files Modified

- `backend/Dockerfile` — added `groupadd`/`useradd` for appuser (1001:1001), `--chown` on all `COPY` directives, `USER appuser`
- `frontend/Dockerfile` — builder stage: added `addgroup`/`adduser` for appuser (1001:1001), `USER appuser`; prod stage: switched to `nginxinc/nginx-unprivileged:alpine`, `EXPOSE 8080`
- `frontend/nginx.conf` — changed `listen 80` → `listen 8080` to match unprivileged image default
- `docker-compose.yml` — added `user: "70:70"` to `db`, `user: "1001:1001"` to `backend`, `user: "101:101"` to `frontend`; updated frontend port mapping to `"80:8080"`
- `docker-compose.dev.yml` — added `user: "1001:1001"` to `backend` and `frontend` overrides
- `TODO.md` — marked rootless containers item as completed