allow container to run as unprivileged user

Dockerfile

@@ -1,22 +1,52 @@
-FROM node:current-slim
+FROM node:current-slim AS builder
 
-# Create app directory
-WORKDIR /usr/src/app
+# Define User ID and Group ID which the Server should run under
+# Should be specified on buld, therfor buildargs
+ARG UID=3000
+ARG GID=3000
 
-# Copy package.json and package-lock.json
-COPY package*.json ./
+# Set the WORKDIR
+# also make it simple so it can not be confused with system files
+WORKDIR /app
 
-# Install app dependencies
-RUN npm ci
+# copy the whole repo into the container because all
+# required files are stored on the project root
+COPY --chown=$UID:$GID . .
 
-# Bundle app source
-COPY . .
+# run npm install and build as root
+# because npm and node store some files und /root for some reason
+RUN npm ci && npm run build \
+    && chown -R $UID:$GID /app # change permission to the specified UID and GID after finish
 
-# Build the TypeScript files
-RUN npm run build
+FROM node:current-slim AS prod
 
-# Expose port 8080
+ARG UID=3000
+ARG GID=3000
+
+# set default env variable for prod
+ENV NODE_ENV="production"
+ENV PORT="8080"
+ENV HOST="0.0.0.0"
+
+WORKDIR /app
+
+# copy the dist folder from the previous stage
+COPY --from=builder --chown=$UID:$GID /app/dist /app/dist
+# we also need the package.json and package-lock.json for the deps
+COPY --from=builder /app/package*.json /app/
+
+# reinstall all prod dependencies (this also needs to run as root)
+# skip scripts (prepare script) because it uses a dev dependency
+RUN npm ci --omit=dev --ignore-scripts \
+    && chown -R $UID:$GID /app # correct permissions
+
+# Drop user to the defined uid and gid
+USER $UID:$GID
+
+# define which port will be exposed
+# this can be build with a build argument
 EXPOSE 8080
 
-# Start the app
-CMD npm run start
+# run server via direct call
+# becuase npm run start requires a dev dependency
+CMD ["dist/index.js"]

src/routes/excelGenerator/excelGeneratorRouter.ts

@@ -26,7 +26,7 @@ excelGeneratorRegistry.registerPath({
 });
 
 // Create folder to contains generated files
-const exportsDir = path.join(__dirname, '../../..', 'excel-exports');
+const exportsDir = '/tmp/excel-exports';
 
 // Ensure the exports directory exists
 if (!fs.existsSync(exportsDir)) {

src/routes/powerpointGenerator/powerpointGeneratorRouter.ts

@@ -28,7 +28,7 @@ powerpointGeneratorRegistry.registerPath({
 });
 
 // Create folder to contains generated files
-const exportsDir = path.join(__dirname, '../../..', 'powerpoint-exports');
+const exportsDir = '/tmp/powerpoint-exports';
 // Ensure the exports directory exists
 if (!fs.existsSync(exportsDir)) {
   fs.mkdirSync(exportsDir, { recursive: true });

src/routes/wordGenerator/wordGeneratorRouter.ts

@@ -45,7 +45,7 @@ wordGeneratorRegistry.registerPath({
 });
 
 // Create folder to contains generated files
-const exportsDir = path.join(__dirname, '../../..', 'word-exports');
+const exportsDir = '/tmp/word-exports';
 // Ensure the exports directory exists
 if (!fs.existsSync(exportsDir)) {
   fs.mkdirSync(exportsDir, { recursive: true });