# Runtime stage
FROM alpine:3.22

# Install dependencies
RUN apk add --no‑cache nginx

# Create non root user and group
RUN addgroup -S webgroup && \
    adduser  -S webuser  -G webgroup

# Workdir
RUN mkdir /usr/share/nginx/root
WORKDIR /usr/share/nginx/root

# Make / Set ownership and premission
RUN chown -R webuser:webgroup /usr/share/nginx/root /var/cache/nginx /var/log/nginx
RUN chmod 750 /usr/share/nginx/root

# Set non root user
USER webuser

# Open ports
EXPOSE 80 443

# Start nginx
CMD ["nginx", "-g", "daemon off;"]