feat: harden production security boundaries

2026-09-07 07:51:25 +07:00
parent 2fa6b68279
commit 687b4c9cb5
13 changed files with 105 additions and 11 deletions
@@ -13,5 +13,7 @@ ENV HOST=0.0.0.0 PORT=4321 NODE_ENV=production
 COPY --from=build /app/package*.json ./
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
+RUN chown -R node:node /app
+USER node
 EXPOSE 4321
 CMD ["node", "./dist/server/entry.mjs"]