update the staging Dockerfile to run as a non-privileged user

Author: apdavison

apps/deployment/Dockerfile.staging

@@ -27,8 +27,17 @@ RUN npm run build
 
 # production environment
 FROM docker-registry.ebrains.eu/model-catalog/nginx:stable-alpine
+
+# Make nginx dirs writable for non-root user (UID 1001)
+RUN chown -R 1001:0 /var/cache/nginx /var/log/nginx /etc/nginx/conf.d && \
+    chmod -R g+w /var/cache/nginx /var/log/nginx /etc/nginx/conf.d && \
+    sed -i 's/^user  nginx;/#user  nginx;/' /etc/nginx/nginx.conf && \
+    sed -i 's|/var/run/nginx.pid|/tmp/nginx.pid|' /etc/nginx/nginx.conf
+
 COPY deployment/nginx-app-staging.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /model-catalog/dist /usr/share/nginx/html/model-catalog
 COPY --from=build /curation-dashboard/dist /usr/share/nginx/html/curation-dashboard
-EXPOSE 80
+
+EXPOSE 8080
+USER 1001
 CMD ["nginx", "-g", "daemon off;"]

apps/deployment/nginx-app-staging.conf

@@ -2,7 +2,7 @@
 
 
 server {
-    listen 80;
+    listen 8080;
 
     location / {
         root   /usr/share/nginx/html/model-catalog;