Improve Container Security with Non-Root User (appuser) (#427)

* chore: add non-root user to Dockerfile for security hardening

* fix: install pipenv dependencies as appuser to resolve vulture command not found

* feat: enhance Dockerfile security hardening with coverage output permissions

* fix: resolve permission issues for non-root user in all environments

* resolve permission error for non-root user in Dockerfile and compose file

* fix: use named volume for test output to avoid permission issues

* remove unnecessary user switching in Dockerfile

* refactor(docker): use named group 'app' for better readability

- Change group creation from numeric GID to named 'app' group
- Improve code readability and maintainability
- Keep same GID (999) for compatibility

Author: rehanshaikh1207

Dockerfile

@@ -46,5 +46,17 @@ ARG APP_ENV
 
 RUN npm run build
 
+# Create non-root user for security - use consistent UID/GID across environments
+RUN groupadd -r -g 999 app && \
+    useradd -r -u 999 -g 999 -m appuser
+
+# Create directories and set ownership for non-root user to write files
+RUN mkdir -p /opt/app/tmp /opt/app/logs /opt/app/output /home/appuser/.cache /app/output && \
+    chown -R appuser:app /opt/app /home/appuser /app/output
+
+# Switch to appuser and install dependencies
+USER appuser
+RUN pipenv install --dev
+
 CMD [ "npm", "start" ]
 

docker-compose.test.yml

@@ -16,8 +16,9 @@ services:
         condition: service_started
       temporal:
         condition: service_healthy
+    # Use named volume to avoid permission issues with bind mounts
     volumes:
-      - ./output:/app/output
+      - test_output:/app/output
 
   app-db:
     image: mongo:5.0
@@ -61,3 +62,7 @@ services:
       POSTGRES_USER: 'temporal'
     ports:
       - '5432:5432'
+
+# Define named volume for test output
+volumes:
+  test_output: