Run frontend Docker installs as non-root

Author: cmm-aoi

frontend/Dockerfile

@@ -8,13 +8,20 @@ RUN apt-get update -qq && \
 
 RUN npm i -g npm@6.14.18
 
+COPY bin/docker-entrypoint /usr/local/bin/frontend-entrypoint
+
+RUN chmod +x /usr/local/bin/frontend-entrypoint && \
+      chown -R node:node /app
+
 ENV CHROME_BIN=/usr/bin/chromium
 ENV OPENSSL_CONF=/dev/null
 
-COPY package*.json bower.json .bowerrc .npmrc ./
-COPY patches ./patches
+USER node
+
+COPY --chown=node:node package*.json bower.json .bowerrc .npmrc ./
+COPY --chown=node:node patches ./patches
 
-RUN npm install --unsafe-perm && \
+RUN npm install && \
       { \
         for file in package.json package-lock.json bower.json .bowerrc .npmrc; do \
           [ -f "$file" ] && sha256sum "$file"; \
@@ -24,11 +31,7 @@ RUN npm install --unsafe-perm && \
         done; \
       } | sha256sum | awk '{print $1}' > ./node_modules/.docker-dependencies-checksum
 
-COPY bin/docker-entrypoint /usr/local/bin/frontend-entrypoint
-
-RUN chmod +x /usr/local/bin/frontend-entrypoint
-
-COPY . .
+COPY --chown=node:node . .
 
 ENTRYPOINT ["/usr/local/bin/frontend-entrypoint"]
 

frontend/bin/docker-entrypoint

@@ -21,7 +21,7 @@ current_checksum="$(dependencies_checksum)"
 if [ ! -x ./node_modules/.bin/ember ] ||
   [ ! -f "$checksum_file" ] ||
   [ "$(cat "$checksum_file")" != "$current_checksum" ]; then
-  npm install --unsafe-perm
+  npm install
   printf '%s\n' "$current_checksum" > "$checksum_file"
 fi
 

frontend/package.json

@@ -11,7 +11,7 @@
   "license": "MIT",
   "author": "",
   "scripts": {
-    "postinstall": "patch-package && ./node_modules/bower/bin/bower --allow-root install",
+    "postinstall": "patch-package && ./node_modules/bower/bin/bower install",
     "build": "ember build --environment=production",
     "lint:js": "eslint ./*.js app config lib server tests",
     "start": "serve dist -l ${PORT:-4300} -s",