From 86b3bbbc1b7d53fcbd5c1629a2c48569d4e7eebd Mon Sep 17 00:00:00 2001
From: Djeex <djeex@djeex.fr>
Date: Sun, 23 Aug 2026 14:28:13 +0200
Subject: [PATCH] Run the container as a non-root user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a static UID/GID 911 user (matching the socket-proxy/adguard-cidre
convention) and drop to it before running main.py. No PUID/PGID env var
or entrypoint chown logic needed here, unlike adguard-cidre — this
container has no volume mount and writes nothing to disk.
---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 65ccc4e..58adedc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,4 +20,8 @@ CMD ["pytest", "-v"]
 
 FROM base
 
+RUN addgroup -g 911 nvbot && adduser -D -u 911 -G nvbot nvbot
+
+USER nvbot
+
 CMD ["python", "main.py"]