Secure Docker setup for Converto

[losolio]

This solution is rendering html from both known and unknown sources. We need to ensure that our Docker setup for Converto is secure and follows the best practices for Docker security. We should use what´s relevant in these guides/articles:

• [OWASP cheat sheet Node js Docker](https://cheatsheetseries.owasp.org/cheatsheets/NodeJS_Docker_Cheat_Sheet.html
• Docker docs: rootless
• Docker docs on security

Tasks:

• Review the current Docker setup and identify any potential vulnerabilities or areas for improvement
• Apply the recommended security measures and configurations to the Dockerfile
• Test the updated Docker setup and verify that it works as expected and does not introduce any new issues or errors

[meinte]

The big issue here is that converto is ran as a plugin, the plugin itself can't be dockerized, what can be dockerized of course is the entire strapi environment. But this then means that the insecure context of puppeteer(not sandboxed) could potentially allow an attacker to break out of the puppeteer context and gain access to the docker container itself - meaning the strapi environment(and with it db/db access) is jeopardised.

[meinte]

If the strapi environment can run outside of Heroku, however, the issue is moot, as we could run puppeteer in sandbox mode.

[losolio]

Thanks for your comments @meinte, I did actually add the whole strapi cms back into this solution! For now the environment is isolated with a separate db and application context, but it would be great to have it sandboxed. The container is running as a Docker container on Azure, so no bindings to Heroku.