From cea0dbffa4d94d576fbd465e534bcb0b5ddf2040 Mon Sep 17 00:00:00 2001
From: XShine555 <xshine555@gmail.com>
Date: Mon, 20 Jul 2026 15:14:04 +0200
Subject: [PATCH] chore(web-player): tighten the container image

There was no .dockerignore, so node_modules and build/ were copied into the
build context on every build. Add one, install from the lockfile with npm ci,
prune the dev dependencies out of the runtime layer and run as the node user.
---
 web-player/.dockerignore | 12 ++++++++++++
 web-player/Dockerfile    |  7 ++++---
 2 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 web-player/.dockerignore

diff --git a/web-player/.dockerignore b/web-player/.dockerignore
new file mode 100644
index 0000000..7db544b
--- /dev/null
+++ b/web-player/.dockerignore
@@ -0,0 +1,12 @@
+node_modules
+build
+.svelte-kit
+.env
+.env.*
+!.env.example
+.git
+.github
+.claude
+.vscode
+docs
+*.md
diff --git a/web-player/Dockerfile b/web-player/Dockerfile
index 482b514..d114075 100644
--- a/web-player/Dockerfile
+++ b/web-player/Dockerfile
@@ -2,16 +2,17 @@
 FROM node:22-alpine AS build
 WORKDIR /src
 COPY package.json package-lock.json ./
-RUN npm install
+RUN npm ci
 COPY . .
-RUN npm run build
+RUN npm run build && npm prune --omit=dev
 
 FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
+ENV PORT=3000
 COPY --from=build /src/build ./build
 COPY --from=build /src/node_modules ./node_modules
 COPY --from=build /src/package.json ./package.json
+USER node
 EXPOSE 3000
-ENV PORT=3000
 CMD ["node", "build/index.js"]