fix(security): exclude local secrets and drop root in dev image

.dockerignore

@@ -1,3 +1,5 @@
+.env
+.env*.local
 node_modules/
 .next/
 .git/

Dockerfile

@@ -25,7 +25,8 @@ RUN npm ci
 COPY --chown=node:node . .
 
 # Use the node user from the image (instead of the root user)
-# USER node
+RUN chown node:node /usr/src/app
+USER node
 
 # For container development, the following command runs forever, so we can inspect the container
 CMD ["npm", "run", ".dev"]

src/__tests__/docker-security.test.ts

@@ -0,0 +1,21 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+describe("Docker build context security", () => {
+  const read = (file: string) => readFileSync(join(process.cwd(), file), "utf8");
+
+  it("excludes local environment secrets from image build contexts", () => {
+    const ignored = read(".dockerignore")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line && !line.startsWith("#"));
+
+    expect(ignored).toContain(".env");
+    expect(ignored).toContain(".env*.local");
+  });
+
+  it("runs the development image as the unprivileged node user", () => {
+    const developmentStage = read("Dockerfile").split("FROM node:lts-alpine AS build")[0];
+    expect(developmentStage).toMatch(/^USER node$/m);
+  });
+});