From 49fcab2ee3c131b273134812d7697083536d6c7a Mon Sep 17 00:00:00 2001 From: Iriome Date: Mon, 27 Apr 2026 14:40:51 +0100 Subject: [PATCH 1/2] fix: allow containers to run as non-root user (UID 1000) - chown public/, dist/, and scripts/ to node:node after build - add USER node directive before EXPOSE in dist-mono and dist-arm Dockerfiles - update CMD to exec form in dist-mono for consistency Fixes running the container with --user 1000 in environments that don't allow containers to run as root. The sed -i in inject-vars.sh requires write permission on ./public/assets/, which previously failed with 'Permission denied' when running as non-root. The node user (UID 1000) is built into the node:20-slim base image. Existing root deployments are unaffected. --- docker/dist-arm/server.Dockerfile | 6 ++++++ docker/dist-mono/server.Dockerfile | 9 +++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/docker/dist-arm/server.Dockerfile b/docker/dist-arm/server.Dockerfile index 208574fe4..ad6c286fb 100644 --- a/docker/dist-arm/server.Dockerfile +++ b/docker/dist-arm/server.Dockerfile @@ -40,6 +40,12 @@ RUN npm run build COPY --from=frontend-build /app/client/dist ./public +RUN chown -R node:node ./public \ + && chown -R node:node ./dist \ + && chown -R node:node ./scripts + +USER node + EXPOSE 52345 CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"] diff --git a/docker/dist-mono/server.Dockerfile b/docker/dist-mono/server.Dockerfile index 5e1bf5c13..860fd2032 100644 --- a/docker/dist-mono/server.Dockerfile +++ b/docker/dist-mono/server.Dockerfile @@ -26,8 +26,13 @@ RUN cp -r src/templates dist/templates COPY --from=frontend-build /app/client/dist ./public -RUN chmod +x ./scripts/inject-vars.sh +RUN chmod +x ./scripts/inject-vars.sh \ + && chown -R node:node ./public \ + && chown -R node:node ./dist \ + && chown -R node:node ./scripts + +USER node EXPOSE 52345 -CMD ./scripts/inject-vars.sh && node ./dist/index.js \ No newline at end of file +CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"] From 53c58eb945be3e90b64e8179ca177fd4ee856446 Mon Sep 17 00:00:00 2001 From: Iriome Date: Fri, 1 May 2026 21:56:40 +0100 Subject: [PATCH 2/2] fix: make non-root support opt-in, keep root as default Remove USER node directive so existing deployments are unaffected. The chown ensures --user 1000 works without changing the default behaviour. --- docker/dist-arm/server.Dockerfile | 1 - docker/dist-mono/server.Dockerfile | 1 - 2 files changed, 2 deletions(-) diff --git a/docker/dist-arm/server.Dockerfile b/docker/dist-arm/server.Dockerfile index ad6c286fb..a522dabfa 100644 --- a/docker/dist-arm/server.Dockerfile +++ b/docker/dist-arm/server.Dockerfile @@ -44,7 +44,6 @@ RUN chown -R node:node ./public \ && chown -R node:node ./dist \ && chown -R node:node ./scripts -USER node EXPOSE 52345 diff --git a/docker/dist-mono/server.Dockerfile b/docker/dist-mono/server.Dockerfile index 860fd2032..3f14d8fc1 100644 --- a/docker/dist-mono/server.Dockerfile +++ b/docker/dist-mono/server.Dockerfile @@ -31,7 +31,6 @@ RUN chmod +x ./scripts/inject-vars.sh \ && chown -R node:node ./dist \ && chown -R node:node ./scripts -USER node EXPOSE 52345