feat(backend): run the container as non-root

Dockerfile

@@ -110,11 +110,18 @@ ENV REPLACE_OS_VARS=true \
 
 WORKDIR /opt/app
 
+# Create plural user and home directory, set owner to plural
+RUN addgroup -g 10001 plural && \
+    adduser -s /bin/sh -u 10001 -G plural -h "/opt/app" -S -D plural && \
+    chown -R 10001:10001 "/opt/app"
+
 COPY --from=tools /usr/local/bin/plural /usr/local/bin/plural
 COPY --from=tools /usr/local/bin/helm /usr/local/bin/helm
 COPY --from=tools /usr/local/bin/goon /usr/local/bin/goon
 COPY --from=tools /usr/local/bin/terrascan /usr/local/bin/terrascan
 COPY --from=tools /usr/local/bin/trivy /usr/local/bin/trivy
-COPY --from=builder /opt/built .
+COPY --from=builder --chown=10001:10001 /opt/built .
+
+USER plural
 
 CMD trap 'exit' INT; /opt/app/bin/${APP_NAME} foreground

rel/config/config.exs

@@ -4,11 +4,11 @@ import System, only: [get_env: 1]
 host = get_env("HOST")
 
 config :api, ApiWeb.Endpoint,
-  url: [host: host, port: 80],
+  url: [host: host, port: 8080],
   check_origin: ["//#{host}", "//plural-api"]
 
 config :rtc, RtcWeb.Endpoint,
-  url: [host: host, port: 80],
+  url: [host: host, port: 8080],
   check_origin: ["//#{host}", "//plural-rtc"]
 
 config :core, hostname: host

rel/config/rtc.exs

@@ -2,7 +2,7 @@ import Config
 import System, only: [get_env: 1]
 
 config :rtc, RtcWeb.Endpoint,
-  url: [host: get_env("HOST"), port: 80],
+  url: [host: get_env("HOST"), port: 8080],
   check_origin: ["//#{get_env("HOST")}", "//plural-rtc"],
   secret_key_base: get_env("SECRET_KEY_BASE"),
   server: true