From 49fcab2ee3c131b273134812d7697083536d6c7a Mon Sep 17 00:00:00 2001 From: Iriome Date: Mon, 27 Apr 2026 14:40:51 +0100 Subject: [PATCH] fix: allow containers to run as non-root user (UID 1000) - chown public/, dist/, and scripts/ to node:node after build - add USER node directive before EXPOSE in dist-mono and dist-arm Dockerfiles - update CMD to exec form in dist-mono for consistency Fixes running the container with --user 1000 in environments that don't allow containers to run as root. The sed -i in inject-vars.sh requires write permission on ./public/assets/, which previously failed with 'Permission denied' when running as non-root. The node user (UID 1000) is built into the node:20-slim base image. Existing root deployments are unaffected. --- docker/dist-arm/server.Dockerfile | 6 ++++++ docker/dist-mono/server.Dockerfile | 9 +++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/docker/dist-arm/server.Dockerfile b/docker/dist-arm/server.Dockerfile index 208574fe4..ad6c286fb 100644 --- a/docker/dist-arm/server.Dockerfile +++ b/docker/dist-arm/server.Dockerfile @@ -40,6 +40,12 @@ RUN npm run build COPY --from=frontend-build /app/client/dist ./public +RUN chown -R node:node ./public \ + && chown -R node:node ./dist \ + && chown -R node:node ./scripts + +USER node + EXPOSE 52345 CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"] diff --git a/docker/dist-mono/server.Dockerfile b/docker/dist-mono/server.Dockerfile index 5e1bf5c13..860fd2032 100644 --- a/docker/dist-mono/server.Dockerfile +++ b/docker/dist-mono/server.Dockerfile @@ -26,8 +26,13 @@ RUN cp -r src/templates dist/templates COPY --from=frontend-build /app/client/dist ./public -RUN chmod +x ./scripts/inject-vars.sh +RUN chmod +x ./scripts/inject-vars.sh \ + && chown -R node:node ./public \ + && chown -R node:node ./dist \ + && chown -R node:node ./scripts + +USER node EXPOSE 52345 -CMD ./scripts/inject-vars.sh && node ./dist/index.js \ No newline at end of file +CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"]