WIP

.github/workflows/pr-test.yml

@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
           cache: 'npm'
           cache-dependency-path: ./e2e/package-lock.json
       - run: npm i
@@ -69,3 +69,5 @@ jobs:
         if: failure()
       # Execute the E2E tests
       - run: npm test
+      - run: docker compose logs
+        if: failure()

Dockerfile

@@ -56,14 +56,21 @@ RUN apk update && apk add \
   ca-certificates \
   ttf-freefont
 
+# Add non-root user with explicit UID and GID 
+RUN addgroup --system --gid 1001 appUser && \
+  adduser --system --uid 1001 appGroup
+
 WORKDIR ${APPDIR}
 
-COPY --from=server-build ${APPDIR}/server ./
-COPY --from=client-build ${APPDIR}/client/dist ./static/
+COPY --chown=appUser:appGroup --from=server-build ${APPDIR}/server ./
+COPY --chown=appUser:appGroup --from=client-build ${APPDIR}/client/dist ./static/
 
 ENV TZ=Europe/Helsinki
 
 # Define Chromium path, as it was not installed in the previous phase
 ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
 
+# Don't run the app as root
+USER appUser
+
 CMD npm start