Fix Dockerfile: run release container as non-root user

[Copilot]

The release stage of the Dockerfile ran as root, violating least-privilege and increasing blast radius if the process is compromised.

Changes

• Dockerfile: After npm ci, transfer ownership of /app to the built-in node user, then drop privileges via USER node before the entrypoint.

RUN npm ci --ignore-scripts --omit-dev && chown -R node:node /app

USER node

ENTRYPOINT ["node", "dist/index.js"]

The node:22-alpine base image ships with a node user (UID 1000), so no new user creation is required. The chown is combined in the same RUN layer to ensure /app (including node_modules) is readable by the unprivileged user before the privilege drop.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.