hardening: run production container as non-root user #19

Merged

matt merged 1 commit from mailship-c3s-docker-run-production-container-as-non-r-4e7 into main

2026-09-18 15:33:57 +00:00

Author	SHA1	Message	Date
Agent	dfdc6d489c	hardening: run production container as non-root user All checks were successful CI / checks (pull_request) Successful in 38s Details Add a dedicated 'app' user/group in the production image stage so the application runs without root privileges. The build stage retains root for apk add of build-time dependencies. Changes: - Create 'app' user and group via addgroup/adduser - Change ownership of /data to app:app - Set USER app before EXPOSE and CMD Closes mailship-c3s	2026-09-18 10:30:52 -04:00

Author

SHA1

Message

Date

Agent

dfdc6d489c

hardening: run production container as non-root user

CI / checks (pull_request) Successful in 38s

Details

Add a dedicated 'app' user/group in the production image stage so the
application runs without root privileges. The build stage retains root
for apk add of build-time dependencies.

Changes:
- Create 'app' user and group via addgroup/adduser
- Change ownership of /data to app:app
- Set USER app before EXPOSE and CMD

Closes mailship-c3s

2026-09-18 10:30:52 -04:00