From 50020a0d76c25e3c40dadcd601e39e5dac6aff2a Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Thu, 23 Oct 2025 15:14:16 +0200
Subject: [PATCH] Run code as the rails user

---
 Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index be438c0ba..b40ca3a79 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -63,6 +63,11 @@ COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer
 
+# Run and own only the runtime files as a non-root user for security
+RUN useradd rails --create-home --shell /bin/bash && \
+    chown -R rails:rails db log storage tmp
+USER rails:rails
+
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]