curo1305
a5baef73d9
- backend: appuser UID/GID 1001 via useradd, USER directive, --chown on COPY - frontend builder: appuser UID/GID 1001 via adduser, USER directive - frontend prod: switch to nginxinc/nginx-unprivileged:alpine (nginx UID 101), listen on 8080 - docker-compose: explicit user: for all services (70:70 db, 1001:1001 backend/frontend-dev, 101:101 frontend-prod) - nginx.conf: listen 8080 to match unprivileged image Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
25 lines
832 B
Docker
25 lines
832 B
Docker
# ── Stage 1: build ────────────────────────────────────────────────────────────
|
|
FROM node:20-alpine AS builder
|
|
|
|
# Create non-root user (UID/GID 1001)
|
|
RUN addgroup -g 1001 appuser && adduser -u 1001 -G appuser -s /bin/sh -D appuser
|
|
|
|
WORKDIR /app
|
|
RUN chown appuser:appuser /app
|
|
|
|
USER appuser
|
|
|
|
COPY --chown=appuser:appuser package.json package-lock.json* ./
|
|
RUN npm ci
|
|
|
|
COPY --chown=appuser:appuser . .
|
|
RUN npm run build
|
|
|
|
# ── Stage 2: serve with nginx (unprivileged, UID 101) ─────────────────────────
|
|
FROM nginxinc/nginx-unprivileged:alpine
|
|
|
|
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
EXPOSE 8080
|