PersonalBlog

T

implementer a4cf365098 feat: run the app image as a non-root user (E00-S02-T05)

The runtime stage of apps/server/Dockerfile now drops root privileges with
'USER node' — the non-root user (uid/gid 1000) the official Node image ships
with — so the app container does not run with root privileges. The server
binds port 3000 (>= 1024) and only reads the root-owned files copied above,
so no extra user creation or ownership changes are required. compose.yaml
header updated: T05 is in scope; T06 (read-only rootfs) and T07 (multi-arch)
remain out of scope.

2026-08-29 00:41:10 +00:00

.gitea/workflows

chore: bootstrap pnpm workspace and package manifests

2026-08-27 23:07:58 +00:00

apps/server

feat: run the app image as a non-root user (E00-S02-T05)

2026-08-29 00:41:10 +00:00

docs/development

feat: app health endpoint succeeds (E00-S02-T03)

2026-08-29 00:21:34 +00:00

extensions/example

feat: add root build/test/typecheck scripts (E00-S01-T05)