From dfdc6d489c6902ee3025990a6440ebe2a09bebea Mon Sep 17 00:00:00 2001
From: Agent <agent@lorentz.is>
Date: Fri, 18 Sep 2026 10:30:52 -0400
Subject: [PATCH] hardening: run production container as non-root user

Add a dedicated 'app' user/group in the production image stage so the
application runs without root privileges. The build stage retains root
for apk add of build-time dependencies.

Changes:
- Create 'app' user and group via addgroup/adduser
- Change ownership of /data to app:app
- Set USER app before EXPOSE and CMD

Closes mailship-c3s
---
 Dockerfile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index f5feb6e..d165a87 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -52,6 +52,12 @@ COPY --from=build /app/src/emails/ ./dist/emails/
 # Create data directory for SQLite
 RUN mkdir -p /data
 
+# Create non-root user for security hardening
+RUN addgroup -S app && adduser -S -G app app
+RUN chown -R app:app /data
+
+USER app
+
 EXPOSE 4738
 
 ENV NODE_ENV=production