From 5e746c11db577a92f7daa0141daedb0a705d5e6b Mon Sep 17 00:00:00 2001 From: dangered wolf Date: Thu, 20 Aug 2026 12:32:55 -0400 Subject: [PATCH] fix(docker): run as dedicated user and not root --- Dockerfile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 218ed4fc..69937b03 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,8 +27,14 @@ FROM base AS runtime ENV NODE_ENV=production ENV WRANGLER_SEND_METRICS=false -COPY --from=build /app /app +RUN groupadd --gid 1001 fxembed \ + && useradd --uid 1001 --gid fxembed --home-dir /app --no-create-home --shell /usr/sbin/nologin fxembed + +COPY --from=build --chown=fxembed:fxembed /app /app +RUN chown fxembed:fxembed /app EXPOSE 8787 +USER fxembed + CMD ["npx", "wrangler", "dev", "./dist/worker.js", "--local", "--ip", "0.0.0.0", "--port", "8787"]