publish1

Dockerfile

@@ -21,9 +21,21 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libcurl4 \
     && rm -rf /var/lib/apt/lists/*
 
+# Run as non-root
+RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
+RUN mkdir -p /app/Data && chown appuser:appgroup /app/Data
+
 COPY --from=build /app/publish .
+RUN chown -R appuser:appgroup /app
+
+USER appuser
 
 ENV ASPNETCORE_URLS=http://+:8080
+ENV ASPNETCORE_ENVIRONMENT=Production
+
+# SQLite database lives here — mount a persistent volume at /app/Data
+VOLUME ["/app/Data"]
+
 EXPOSE 8080
 
 ENTRYPOINT ["dotnet", "EntKube.Web.dll"]