FROM alpine:latest

RUN apk --no-cache add ca-certificates

WORKDIR /app

COPY . .

# Create non-root user
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

USER appuser

EXPOSE 8080

CMD ["./start.sh"]