From 72faa57367f67350b4f39508313e812307af997a Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:40:49 +0100
Subject: [PATCH] fix: keep the app files in the Docker image read-only for the
 user it runs as

---
 Dockerfile | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index f41759013..8b3346acc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -50,10 +50,14 @@ RUN apk upgrade --no-cache && \
     rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npx && \
     addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
+# The app stays root's and read-only for the runtime user, so a bug that
+# lets it write a file can't replace server.js or a bundle and run code on
+# the next start. It writes only to Next's cache and the data dirs.
 COPY --from=builder /app/public ./public
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-RUN mkdir -p /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && chown -R nextjs:nodejs /app/data
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+RUN mkdir -p /app/.next/cache /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && \
+    chown -R nextjs:nodejs /app/.next/cache /app/data
 USER nextjs
 EXPOSE 3000
 ENV PORT=3000