From def0eec9f87ecefcd37dec7eaaf4df50779fd06a Mon Sep 17 00:00:00 2001
From: Patrick Scheid <p.scheid92@gmail.com>
Date: Sun, 22 Feb 2026 22:25:11 +0100
Subject: [PATCH] Add non-root USER directive to Dockerfile

Run the container as an unprivileged user to limit the blast radius
of a potential container escape.
---
 Dockerfile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 64ae7c5..aa8a672 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,9 +26,15 @@ FROM alpine:latest
 
 WORKDIR /app
 
+# Create non-root user
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
 # Copy binary from builder (templates are embedded via go:embed)
 COPY --from=builder /build/server .
 
+# Switch to non-root user
+USER appuser
+
 # Expose port
 EXPOSE 8080