Run node.js in a more isolated process

Author: mythz

Dockerfile

@@ -67,11 +67,19 @@ RUN apt-get update \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy published .NET app
+# Create unprivileged user for Node.js
+RUN groupadd -r nodeuser && useradd -r -g nodeuser -s /bin/bash nodeuser
+
+# Copy published .NET app (owned by root, no access for nodeuser)
 COPY --from=dotnet-build /src/MyApp/bin/Release/net10.0/publish ./api
+RUN chmod -R 700 ./api && chown -R root:root ./api
 
-# Copy built Next.js app (including dist, node_modules, public, etc.)
+# Copy built Next.js app (owned by nodeuser, read-only)
 COPY --from=dotnet-build /src/MyApp.Client ./client
+RUN chown -R nodeuser:nodeuser ./client && chmod -R 500 ./client
+
+# Create /tmp directory accessible to nodeuser
+RUN mkdir -p /tmp && chmod 1777 /tmp
 
 ENV ASPNETCORE_URLS=http://0.0.0.0:8080 \
     INTERNAL_API_URL=http://127.0.0.1:8080 \

entrypoint.sh

@@ -13,15 +13,25 @@ if [[ "$*" == *"--AppTasks"* ]]; then
 fi
 
 echo "Starting ASP.NET Core on ${ASPNETCORE_URLS}..."
-DOTNET_ENV_VARS=("ASPNETCORE_URLS=${ASPNETCORE_URLS}")
 
-# Start ASP.NET Core application with correct content root so appsettings.json is loaded
+# Start ASP.NET Core application as root with full environment
 ASPNETCORE_CONTENTROOT="/app/api" ASPNETCORE_URLS="${ASPNETCORE_URLS}" dotnet /app/api/MyApp.dll &
 DOTNET_PID=$!
 
-echo "Starting Next.js on port ${NEXT_PORT}..."
+echo "Starting Next.js on port ${NEXT_PORT} as isolated user..."
+
+# Start Node.js with minimal environment and as unprivileged user
+# Only pass through safe environment variables
+cd /app/client && su nodeuser -s /bin/bash -c "
+export HOME=/tmp
+export NODE_ENV=production
+export NEXT_PORT=${NEXT_PORT}
+export INTERNAL_API_URL=${INTERNAL_API_URL:-http://127.0.0.1:8080}
+export KAMAL_DEPLOY_HOST=${KAMAL_DEPLOY_HOST}
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 cd /app/client
-npm run start -- --port "${NEXT_PORT}" &
+npm run start -- --port ${NEXT_PORT}
+" &
 NEXT_PID=$!
 
 term_handler() {