# Learning template for the fixed Fieldnotes fixture. Build from the kit folder.
# For a real release, select and maintain a reviewed base-image digest.
FROM node:24-alpine
WORKDIR /app
COPY --chown=node:node app.mjs security.test.mjs verify-lab.mjs ./
USER node
# A broken ownership check stops the image build.
RUN node --test security.test.mjs
ENV NODE_ENV=production
ENV HOST=0.0.0.0
EXPOSE 3000
HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 CMD node -e "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "app.mjs"]