Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions docker/web-parser/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
FROM node:22.17.1-alpine AS base
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright

# Builder stage
FROM base AS builder
Expand All @@ -17,10 +18,7 @@ WORKDIR /app

# Copy built artifacts from builder
COPY --from=builder /app/apps/web-parser/.output .

COPY --from=builder /root/.cache/ms-playwright /opt/ms-playwright
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright

COPY --from=builder /opt/ms-playwright /opt/ms-playwright
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

COPY as non-root to prevent permission quirks.

All files under /opt/ms-playwright are currently owned by root.
Running the app as appuser works for read-only access, but Playwright occasionally writes temporary data (e.g., user-data-dir). A safer pattern is:

-COPY --from=builder /opt/ms-playwright /opt/ms-playwright
+COPY --chown=appuser:appgroup --from=builder /opt/ms-playwright /opt/ms-playwright

That keeps the container 100 % read-/write consistent and avoids subtle “permission denied” crashes when upgrading Playwright in the future.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
COPY --from=builder /opt/ms-playwright /opt/ms-playwright
COPY --chown=appuser:appgroup --from=builder /opt/ms-playwright /opt/ms-playwright
🤖 Prompt for AI Agents
In docker/web-parser/Dockerfile at line 21, the COPY command copies files owned
by root, causing permission issues when the app runs as a non-root user. To fix
this, copy the files as the non-root user or adjust ownership after copying so
that /opt/ms-playwright and its contents are owned by the appuser. This ensures
consistent read/write permissions and prevents permission denied errors during
runtime.

COPY docker/web-parser/health-check.sh ./

# Running as non-root is a security best practice
Expand Down
2 changes: 1 addition & 1 deletion docker/web-parser/health-check.sh
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
#!/bin/sh
curl -f http://localhost:3000/health || exit 1
curl -f http://localhost:3000/api/health || exit 1