Merge pull request #98 from jmhbnz/master

Switched to non root user

Dockerfile

@@ -1,4 +1,5 @@
-FROM node:12 as builder
+## Build API
+FROM node:12 as api
 
 WORKDIR /usr/src/app
 
@@ -7,17 +8,27 @@ COPY ui/ .
 RUN yarn install --frozen-lockfile
 RUN yarn export
 
-FROM node:12
+## Build APP
+FROM node:12 as app
 LABEL maintainer="OhMyForm <admin@ohmyform.com>"
 
 WORKDIR /usr/src/app
 
 COPY api/ .
-COPY --from=builder /usr/src/app/out /usr/src/app/public
+COPY --from=api /usr/src/app/out /usr/src/app/public
 
 RUN yarn install --frozen-lockfile
 RUN yarn build
+## Glue
+RUN addgroup --gid 9999 ohmyform && adduser --disabled-login --uid 9999 --gid 9999 ohmyform && \
+      touch /usr/src/app/src/schema.gql && chown ohmyform:ohmyform /usr/src/app/src/schema.gql
 
+## Production Image.
+FROM node:12
+
+WORKDIR /usr/src/app
+COPY --from=app /usr/src/app /usr/src/app
+RUN addgroup --gid 9999 ohmyform && adduser --disabled-login --uid 9999 --gid 9999 ohmyform
 ENV PORT=3000 \
     SECRET_KEY=ChangeMe \
     CREATE_ADMIN=FALSE \
@@ -26,5 +37,5 @@ ENV PORT=3000 \
     ADMIN_PASSWORD=root
 
 EXPOSE 3000
-
+USER ohmyform
 CMD [ "yarn", "start:prod" ]