Use non-root approach to enforce the container security!

Change the default user from root to nonroot (this user should belong to the root group to be compatible with arbitrary UIDs):

...
EXPOSE 80
  RUN useradd -r -u 1001 -g root nonroot
  USER nonroot
CMD ["node", "/app/server.js"]
...

Adapt the container to use alternative port such as 8080:

• Dockerfile:

...
COPY --from=builder /tiller-proxy /proxy
- EXPOSE 80
  EXPOSE 8080
USER nonroot
...

• server.js:

...
const serverHost = '127.0.0.1';
- const serverPort = 80;
  const serverPort = 8080;
...

Give permissions to the group in the /var/log/ directory (nonroot will be able to write since it belongs to the root group):

...
RUN useradd -r -u 1001 -g root nonroot
  RUN chmod -R g rwX /var/log
USER nonroot
...

• 7-workdir