FROM node:20-alpine
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
# Drop root for the dev runtime — node:alpine ships a `node` user (uid
# 1000) for exactly this purpose. Audit caught that running as root in
# dev is an unnecessary risk when the bind-mounted source lets a
# compromised process write anywhere in the repo.
USER node
WORKDIR /home/node/app
COPY --chown=node:node package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile
EXPOSE 3000
CMD ["pnpm", "dev"]