Add non-root user support and entrypoint script for Docker setup

Dockerfile

@@ -19,20 +19,23 @@ ENV NODE_ENV=production
 # DATA_DIR is the single volume mount point for both SQLite and uploads
 ENV DATA_DIR=/data
 
-# Create a non-root user
-RUN addgroup --system --gid 1001 nodejs && \
-    adduser --system --uid 1001 nextjs && \
+# Create a non-root user with default UID/GID (overridable at runtime via PUID/PGID)
+RUN apk add --no-cache su-exec shadow && \
+    addgroup --gid 1001 nodejs && \
+    adduser --uid 1001 --ingroup nodejs --disabled-password --gecos "" nextjs && \
     mkdir -p /data/uploads && chown -R nextjs:nodejs /data
 
 # Copy standalone build output
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
-
-USER nextjs
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
 
 EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
+ENV PUID=1001
+ENV PGID=1001
 
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["node", "server.js"]

docker-compose.yml

@@ -6,7 +6,8 @@ services:
     volumes:
       - app_data:/data
     environment:
-      - DATA_DIR=/data
+      PUID: 1000
+      PGID: 1000
     restart: unless-stopped
 
 volumes:

entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+PUID=${PUID:-1001}
+PGID=${PGID:-1001}
+
+# Only remap if the requested IDs differ from the defaults baked into the image
+if [ "$PGID" != "1001" ]; then
+  groupmod -g "$PGID" nodejs
+fi
+if [ "$PUID" != "1001" ]; then
+  usermod -u "$PUID" nextjs
+fi
+
+chown -R nextjs:nodejs /data
+
+exec su-exec nextjs "$@"