dockerfile (non-root user)

Dockerfile

 FROM hugomods/hugo:dart-sass
-WORKDIR /app
 
-# Systemabhängigkeiten (Puppeteer / Chromium / GUI-Komponenten / Fonts)
+# Chromium Pakete für Puppeteer
 RUN apk add --no-cache \
-  alsa-lib \
-  atk \
-  cairo \
-  cups-libs \
-  dbus-libs \
-  expat \
-  fontconfig \
-  freetype \
-  gcc \
-  gcompat \
-  gdk-pixbuf \
-  glib \
-  gtk+3.0 \
-  nspr \
-  nss \
-  pango \
-  libx11 \
-  libxcomposite \
-  libxcursor \
-  libxdamage \
-  libxext \
-  libxfixes \
-  libxi \
-  libxrandr \
-  libxrender \
-  libxss \
-  libxtst \
-  ca-certificates \
-  ttf-liberation \
-  xdg-utils \
-  wget \
-  chromium \
-  harfbuzz \
-  font-noto \
-  font-noto-cjk \
-  font-noto-emoji \
-  bash
+    openssl \
+    chromium \
+    harfbuzz \
+    ca-certificates \
+    ttf-freefont \
+    nss \
+    freetype \
+    font-noto \
+    font-noto-cjk \
+    font-noto-emoji 
 
 RUN apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing lychee
 
-# Fallback für Puppeteer 
+# Installiere pa11y-ci
+RUN npm install -g pa11y-ci
+
+# Non-root User einrichten
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
+# Setze Umgebungsvariablen für Puppeteer
 ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
 ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+ENV PUPPETEER_ARGS="--no-sandbox --disable-setuid-sandbox"
 
-# Beispiel: pa11y install
-RUN npm install -g pa11y
-
-CMD ["sh"]
+USER appuser
+WORKDIR /home/appuser

Dockerfile.backup

-FROM hugomods/hugo:dart-sass-go-git
-# hugo:dart-sass-go-git ohne node, da node23 Probleme mit pa11y-ci verursacht
-# Fallback: node20
-WORKDIR /app
-
-# Installiere Chromium für Puppeteer
-RUN apk add --no-cache \
-    openssl \
-    chromium \
-    harfbuzz \
-    ca-certificates \
-    ttf-freefont \
-    nss \
-    freetype \
-    font-noto \
-    font-noto-cjk \
-    font-noto-emoji \
-    curl \
-    tar \
-    xz
-
-RUN apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing lychee
-
-# Installiere Node.js 20.19.0 
-ENV NODE_VERSION=20.19.0
-
-RUN curl -fsSL https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.xz | tar -xJ && \
-    mv node-v$NODE_VERSION-linux-x64 /usr/local/node && \
-    ln -sf /usr/local/node/bin/node /usr/local/bin/node && \
-    ln -sf /usr/local/node/bin/npm /usr/local/bin/npm && \
-    ln -sf /usr/local/node/bin/npx /usr/local/bin/npx
-
-# Installiere pa11y-ci und lychee global
-RUN npm install -g pa11y-ci
-
-# Setze Umgebungsvariablen für Puppeteer
-ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
-ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
-ENV PUPPETEER_ARGS="--no-sandbox --disable-setuid-sandbox"