ci: update frontend docker

frontend/Dockerfile

@@ -40,12 +40,8 @@ LABEL org.opencontainers.image.version="1.0.0"
 LABEL org.opencontainers.image.source="https://github.com/darkraise/flashpoint-web"
 
 # Install runtime dependencies
-# - curl: health checks
-# - tzdata: timezone support
-# - su-exec: lightweight tool to drop privileges (like gosu)
-# - shadow: provides usermod/groupmod for dynamic UID/GID
 # - gettext: provides envsubst for nginx config templating
-RUN apk add --no-cache curl tzdata su-exec shadow gettext
+RUN apk add --no-cache gettext
 
 # Copy built files from builder
 COPY --from=builder /app/frontend/dist /usr/share/nginx/html
@@ -62,28 +58,20 @@ COPY frontend/docker-entrypoint.sh /docker-entrypoint.sh
 ENV BACKEND_HOST=backend \
     BACKEND_PORT=3100
 
-# Create non-root user with default UID/GID 1000
-# These can be overridden at runtime via PUID/PGID environment variables
-RUN addgroup -g 1000 -S appuser && \
-    adduser -S appuser -u 1000 -G appuser && \
-    chown -R appuser:appuser /usr/share/nginx/html && \
-    chown -R appuser:appuser /etc/nginx/conf.d && \
+# Set up permissions for nginx user (already exists in nginx:alpine)
+RUN chown -R nginx:nginx /usr/share/nginx/html && \
+    chown -R nginx:nginx /etc/nginx/conf.d && \
     chmod +x /docker-entrypoint.sh
 
 # Expose port (8080 for non-root user)
 EXPOSE 8080
 
-# Health check
+# Health check (using wget which is built into Alpine)
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD curl --fail http://localhost:8080/ || exit 1
+  CMD wget --quiet --spider http://localhost:8080/ || exit 1
 
-# Environment variables for dynamic UID/GID (optional)
-# Set these to match your host user's UID/GID
-ENV PUID=1000
-ENV PGID=1000
-
-# Start as root, entrypoint will drop privileges after setting up user
-USER root
+# Run as non-root user (nginx user from base image)
+USER nginx
 
 # Production command using entrypoint script
 ENTRYPOINT ["/docker-entrypoint.sh"]

frontend/docker-entrypoint.sh

@@ -5,93 +5,26 @@ set -e
 # Docker Entrypoint for Flashpoint Web Frontend
 # =============================================================================
 # This script handles:
-# 1. Dynamic UID/GID setup (via PUID/PGID environment variables)
-# 2. Nginx configuration templating
-# 3. Application startup with dropped privileges
+# 1. Nginx configuration templating
+# 2. Application startup
 # =============================================================================
 
-echo "🌐 Flashpoint Web Frontend - Starting..."
-
-# =============================================================================
-# Dynamic UID/GID Setup
-# =============================================================================
-# Supports PUID/PGID environment variables to match host user permissions
-
-PUID=${PUID:-1000}
-PGID=${PGID:-1000}
-APP_USER="appuser"
-APP_GROUP="appuser"
-
-setup_user() {
-    local current_uid
-    local current_gid
-
-    current_uid=$(id -u $APP_USER 2>/dev/null || echo "")
-    current_gid=$(id -g $APP_USER 2>/dev/null || echo "")
-
-    # Check if we need to modify UID/GID
-    if [ "$current_uid" != "$PUID" ] || [ "$current_gid" != "$PGID" ]; then
-        echo "🔧 Adjusting user UID/GID..."
-        echo "   PUID: $PUID (was: $current_uid)"
-        echo "   PGID: $PGID (was: $current_gid)"
-
-        # Modify group GID if different
-        if [ "$current_gid" != "$PGID" ]; then
-            # Check if target GID is already in use by another group
-            existing_group=$(getent group "$PGID" 2>/dev/null | cut -d: -f1 || true)
-            if [ -n "$existing_group" ] && [ "$existing_group" != "$APP_GROUP" ]; then
-                delgroup "$existing_group" 2>/dev/null || true
-            fi
-            # Alpine uses different syntax
-            sed -i "s/^${APP_GROUP}:x:[0-9]*:/${APP_GROUP}:x:${PGID}:/" /etc/group 2>/dev/null || true
-        fi
-
-        # Modify user UID if different
-        if [ "$current_uid" != "$PUID" ]; then
-            # Check if target UID is already in use by another user
-            existing_user=$(getent passwd "$PUID" 2>/dev/null | cut -d: -f1 || true)
-            if [ -n "$existing_user" ] && [ "$existing_user" != "$APP_USER" ]; then
-                deluser "$existing_user" 2>/dev/null || true
-            fi
-            # Alpine uses different syntax
-            sed -i "s/^${APP_USER}:x:[0-9]*:[0-9]*:/${APP_USER}:x:${PUID}:${PGID}:/" /etc/passwd 2>/dev/null || true
-        fi
-    else
-        echo "✅ User UID/GID OK (UID=$PUID, GID=$PGID)"
-    fi
-
-    # Fix ownership of directories that may be mounted as volumes
-    echo "🔧 Ensuring correct ownership of app directories..."
-    chown -R $APP_USER:$APP_GROUP /usr/share/nginx/html 2>/dev/null || true
-    chown -R $APP_USER:$APP_GROUP /etc/nginx/conf.d 2>/dev/null || true
-}
-
-# Only setup user if running as root
-if [ "$(id -u)" = "0" ]; then
-    setup_user
-fi
+echo "Flashpoint Web Frontend - Starting..."
 
 # =============================================================================
 # Nginx Configuration Templating
 # =============================================================================
 # Process nginx config template with environment variables
 
-echo "📝 Processing nginx configuration..."
+echo "Processing nginx configuration..."
 envsubst '${BACKEND_HOST} ${BACKEND_PORT}' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf
 
 # Display configuration summary
 echo ""
-echo "📋 Configuration Summary:"
-echo "   Backend: ${BACKEND_HOST}:${BACKEND_PORT}"
-echo "   Running as UID: ${PUID}, GID: ${PGID}"
+echo "Configuration Summary:"
+echo "  Backend: ${BACKEND_HOST}:${BACKEND_PORT}"
 echo ""
 
-# Start the application
-echo "🚀 Starting Nginx..."
-
-# If running as root, drop privileges using su-exec
-if [ "$(id -u)" = "0" ]; then
-    exec su-exec $APP_USER nginx -g "daemon off;"
-else
-    exec nginx -g "daemon off;"
-fi
+# Start nginx
+echo "Starting Nginx..."
+exec nginx -g "daemon off;"