build: use non-root user for API container

kordis-leitstelle · Feb 1, 2024 · 61696a5 · 61696a5
1 parent f8367c8
commit 61696a5
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
@@ -13,9 +13,9 @@ RUN npm --omit=dev ci
 COPY ./dist/apps/api ./
 
 # Use distroless for maximum security: https://github.com/GoogleContainerTools/distroless
-FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian11
+FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12:nonroot
 
-COPY --from=builder /app /app
+COPY --chown=nonroot --from=builder /app /app
 WORKDIR /app
 
 ENV PORT=3333