Docker: Image startet und laeuft als Non-Root (node 1000:1000)

Dockerfile

@@ -12,12 +12,13 @@ WORKDIR /app
 ENV NODE_ENV=production \
   DATA_DIR=/app/data \
   BACKUPS_DIR=/app/backups
-RUN groupadd -r app && useradd -r -g app app \
-  && mkdir -p /app/data /app/backups && chown -R app:app /app
-COPY --from=builder --chown=app:app /app/.next/standalone ./
-COPY --from=builder --chown=app:app /app/.next/static ./.next/static
-COPY entrypoint.sh /app/entrypoint.sh
+RUN mkdir -p /app/data /app/backups && chown -R node:node /app
+COPY --from=builder --chown=node:node /app/.next/standalone ./
+COPY --from=builder --chown=node:node /app/.next/static ./.next/static
+COPY --chown=node:node entrypoint.sh /app/entrypoint.sh
 RUN chmod +x /app/entrypoint.sh
+# Non-root: der Container startet direkt als node (UID:GID 1000:1000), kein root beim Start.
+USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
   CMD node -e "fetch('http://127.0.0.1:3000/api/health').then((r) => { if (!r.ok) process.exit(1); }).catch(() => process.exit(1))"