feat: harden production security boundaries

2026-09-07 07:51:25 +07:00
parent 2fa6b68279
commit 687b4c9cb5
13 changed files with 105 additions and 11 deletions
@@ -3,7 +3,9 @@ WORKDIR /app
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
 COPY apps/api/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
-COPY apps/api .
-COPY rf4_research ./rf4_research
+RUN useradd --create-home --uid 10001 rf4
+COPY --chown=rf4:rf4 apps/api .
+COPY --chown=rf4:rf4 rf4_research ./rf4_research
+USER rf4
 EXPOSE 8000
 CMD ["sh", "-c", "alembic upgrade head && python -m app.seed && uvicorn app.main:app --host 0.0.0.0 --port 8000 --no-access-log"]