diff --git a/Dockerfile.standalone-infisical b/Dockerfile.standalone-infisical index 737067534..5c1f15ca3 100644 --- a/Dockerfile.standalone-infisical +++ b/Dockerfile.standalone-infisical @@ -55,6 +55,7 @@ VOLUME /app/.next/cache/images COPY --chown=non-root-user:nodejs --chmod=555 frontend/scripts ./scripts COPY --from=frontend-builder /app/public ./public RUN chown non-root-user:nodejs ./public/data + COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/standalone ./ COPY --from=frontend-builder --chown=non-root-user:nodejs /app/.next/static ./.next/static @@ -93,9 +94,18 @@ RUN mkdir frontend-build # Production stage FROM base AS production +RUN apk add --upgrade --no-cache ca-certificates RUN addgroup --system --gid 1001 nodejs \ && adduser --system --uid 1001 non-root-user +# Give non-root-user permission to update SSL certs +RUN chown -R non-root-user /etc/ssl/certs +RUN chown non-root-user /etc/ssl/certs/ca-certificates.crt +RUN chmod -R u+rwx /etc/ssl/certs +RUN chmod u+rw /etc/ssl/certs/ca-certificates.crt +RUN chown non-root-user /usr/sbin/update-ca-certificates +RUN chmod u+rx /usr/sbin/update-ca-certificates + ## set pre baked keys ARG POSTHOG_API_KEY ENV NEXT_PUBLIC_POSTHOG_API_KEY=$POSTHOG_API_KEY \ diff --git a/standalone-entrypoint.sh b/standalone-entrypoint.sh index 3f88260e9..8fcdb26e7 100755 --- a/standalone-entrypoint.sh +++ b/standalone-entrypoint.sh @@ -1,5 +1,7 @@ #!/bin/sh +update-ca-certificates + cd frontend-build scripts/initialize-standalone-build.sh