fix(docker): updated docker to use non-root user for k8s/helm deployments

[waleedlatif1]

Summary

updated docker to use non-root user for k8s/helm deployments to follow https://github.com/vercel/next.js/tree/canary/examples/with-docker and https://www.docker.com/blog/understanding-the-docker-user-instruction/

Type of Change

• Bug fix

Testing

Tested manually, follows nextjs best practice docs

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Ready	Preview	Comment	Oct 14, 2025 10:49pm

[greptile-apps]

Greptile Overview

Summary

Implements non-root user (nextjs:nodejs, UID 1001) across all three Dockerfiles following Next.js and Docker security best practices for Kubernetes/Helm deployments.

Key changes:

• Creates non-root user with consistent UID 1001 across all containers
• Adds --chown=nextjs:nodejs to COPY commands for proper file ownership
• Switches to non-root user before starting application processes

Issues found:

• app.Dockerfile: Missing --chown on public directory COPY (line 70)
• app.Dockerfile: Guardrails setup script runs as root, creating venv files owned by root, then attempts to fix with chown -R - this creates a permission inconsistency that could cause runtime errors when the app tries to update the Python virtual environment

Confidence Score: 2/5

• This PR has critical permission issues in app.Dockerfile that will likely cause runtime failures
• While the overall approach follows best practices, app.Dockerfile has two permission issues: (1) public directory missing --chown flag, and (2) guardrails setup running as root before USER switch, which will create root-owned venv files that the non-root user cannot modify at runtime. The db.Dockerfile and realtime.Dockerfile are implemented correctly.
• docker/app.Dockerfile requires immediate attention for permission issues on lines 70 and 75-80

Important Files Changed

File Analysis

Filename	Score	Overview
docker/app.Dockerfile	2/5	Non-root user implementation has permission issues with guardrails setup and public directory
docker/db.Dockerfile	5/5	Clean non-root user implementation with proper file ownership
docker/realtime.Dockerfile	5/5	Clean non-root user implementation with proper file ownership

Sequence Diagram

sequenceDiagram
participant K8s as Kubernetes/Helm
participant AppContainer as App Container
participant DBContainer as DB Container
participant RealtimeContainer as Realtime Container
participant User as nextjs:nodejs (UID 1001)
Note over K8s,RealtimeContainer: Deployment Phase
K8s->>AppContainer: Deploy app.Dockerfile
AppContainer->>AppContainer: Create nextjs:nodejs user (UID 1001)
AppContainer->>AppContainer: Copy files with --chown=nextjs:nodejs
AppContainer->>AppContainer: Run guardrails setup as root
AppContainer->>AppContainer: Create cache dir & chown -R nextjs:nodejs
AppContainer->>User: Switch USER to nextjs
User->>AppContainer: Start Next.js on port 3000
K8s->>DBContainer: Deploy db.Dockerfile
DBContainer->>DBContainer: Create nextjs:nodejs user (UID 1001)
DBContainer->>DBContainer: Copy files with --chown=nextjs:nodejs
DBContainer->>User: Switch USER to nextjs
User->>DBContainer: Run database migrations
K8s->>RealtimeContainer: Deploy realtime.Dockerfile
RealtimeContainer->>RealtimeContainer: Create nextjs:nodejs user (UID 1001)
RealtimeContainer->>RealtimeContainer: Copy files with --chown=nextjs:nodejs
RealtimeContainer->>User: Switch USER to nextjs
User->>RealtimeContainer: Start socket server on port 3002
Note over AppContainer,RealtimeContainer: All containers run as non-root (UID 1001)

Loading

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}