From c29ab778a02b48a41c476e4c278d36c0d82b8e4c Mon Sep 17 00:00:00 2001
From: "Sven (AAMOS AI)" <sven@wavult.com>
Date: Tue, 11 Aug 2026 17:29:00 +0700
Subject: [PATCH] harden(docker): non-root USER i Dockerfile.admin

---
 infrastructure/docker/Dockerfile.admin | 6 +++++-
 infrastructure/docker/nginx-admin.conf | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/infrastructure/docker/Dockerfile.admin b/infrastructure/docker/Dockerfile.admin
index 1750081..510f6f5 100644
--- a/infrastructure/docker/Dockerfile.admin
+++ b/infrastructure/docker/Dockerfile.admin
@@ -12,6 +12,10 @@ RUN pnpm install --frozen-lockfile --filter @app/admin...
 RUN pnpm --filter @app/admin build
 
 FROM nginx:alpine AS runtime
+RUN addgroup -S app && adduser -S app -G app
+WORKDIR /app
 COPY --from=builder /build/apps/admin/dist /usr/share/nginx/html
 COPY infrastructure/docker/nginx-admin.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+RUN chown -R app:app /usr/share/nginx/html /var/cache/nginx /var/log/nginx /etc/nginx/conf.d
+USER app
+EXPOSE 8080
diff --git a/infrastructure/docker/nginx-admin.conf b/infrastructure/docker/nginx-admin.conf
index 7191195..bd2e55c 100644
--- a/infrastructure/docker/nginx-admin.conf
+++ b/infrastructure/docker/nginx-admin.conf
@@ -1,5 +1,5 @@
 server {
-  listen 80;
+  listen 8080;
   server_name _;
   root /usr/share/nginx/html;
   index index.html;