security(docker): run containers as non-root user

[HirokiKobayashi-R]

Summary

• Run both server and webapp containers as non-root users, following container security best practices
• Dockerfile.server: add USER node directive with --chown=node:node on COPY steps
• Dockerfile.webapp: switch to nginxinc/nginx-unprivileged:alpine and listen on port 8080

Motivation

Both Dockerfiles previously ran as root inside the container. Running as non-root is an industry-standard hardening practice that limits the blast radius if the container process is compromised.

Changes

Dockerfile.server

• Added --chown=node:node to COPY --from=builder directives so the node user owns the application files
• Added USER node before EXPOSE / CMD

Dockerfile.webapp

• Replaced nginx:alpine with nginxinc/nginx-unprivileged:alpine (official Nginx non-root image)
• Changed listen 80 to listen 8080 (non-root users cannot bind to ports below 1024)
• Updated EXPOSE from 80 to 8080

Breaking changes

• Webapp port changed from 80 to 8080. Any reverse proxy, load balancer, or docker run -p mapping that targets port 80 inside the container must be updated to 8080.

Test plan

• docker build -f Dockerfile.server . builds successfully
• docker build -f Dockerfile.webapp . builds successfully
• Server container runs and responds on port 3000
• Webapp container runs and serves static files on port 8080
• Verify processes run as non-root: docker exec <container> whoami