Run code as the rails user

2025-10-23 15:14:16 +02:00
parent bb4c5ada03
commit 50020a0d76
1 changed files with 5 additions and 0 deletions
@@ -63,6 +63,11 @@ COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer

+# Run and own only the runtime files as a non-root user for security
+RUN useradd rails --create-home --shell /bin/bash && \
+    chown -R rails:rails db log storage tmp
+USER rails:rails
+
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]