From 0e8de6723997bc861d0f3b805f9dc7c674717d0b Mon Sep 17 00:00:00 2001
From: Hamza Alqurneh <hamza@simplify9.com>
Date: Mon, 10 Aug 2026 13:12:21 +0300
Subject: [PATCH] Run the UI container as a non-root user

Switches to nginx-unprivileged and moves the internal port to 8080,
since ports below 1024 require root. The Service's external port is unchanged.
---
 Dockerfile                      | 4 ++--
 chart/templates/deployment.yaml | 5 ++++-
 chart/templates/service.yaml    | 2 +-
 nginx/nginx.conf                | 2 +-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 26c8598..3d383ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,10 +9,10 @@ COPY . /app
 RUN yarn build
 
 # production environment
-FROM nginx:stable-alpine
+FROM nginxinc/nginx-unprivileged:stable-alpine
 COPY --from=build /app/build /usr/share/nginx/html
 RUN rm /etc/nginx/conf.d/default.conf
 COPY nginx/nginx.conf /etc/nginx/conf.d
 
-EXPOSE 80
+EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]
\ No newline at end of file
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index 1951b7c..f4d9068 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -26,9 +26,12 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repo }}/{{ .Chart.Name }}:{{ .Chart.Version }}"
           imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 101
           ports:
             - name: http
-              containerPort: 80
+              containerPort: 8080
               protocol: TCP
           {{- if .Values.probes.enabled }}
           livenessProbe:
diff --git a/chart/templates/service.yaml b/chart/templates/service.yaml
index 210ab73..3f56c26 100644
--- a/chart/templates/service.yaml
+++ b/chart/templates/service.yaml
@@ -11,7 +11,7 @@ spec:
   type: ClusterIP
   ports:
     - port: {{ .Values.service.port | default 80 }}
-      targetPort: 80
+      targetPort: 8080
       protocol: TCP
       name: http
   selector:
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index d4d02d2..a6975fe 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -1,5 +1,5 @@
 server {
-  listen 80;
+  listen 8080;
   location / {
     root   /usr/share/nginx/html;
     index  index.html index.htm;