fix: run nginx as root, serve files as userapp

docker/Dockerfile

@@ -5,24 +5,21 @@ FROM nginx:alpine
 RUN addgroup -g 1000 -S userapp && \
     adduser -u 1000 -S userapp -G userapp
 
+# Create required directories with proper permissions
+RUN mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy && \
+    chown -R userapp:userapp /var/cache/nginx
+
 # Remove default nginx config
 RUN rm /etc/nginx/conf.d/default.conf
 
-# Create directories with proper permissions
-RUN mkdir -p /usr/share/nginx/html /var/cache/nginx/client_temp && \
-    chown -R userapp:userapp /usr/share/nginx/html /var/cache/nginx
-
 # Copy nginx config
 COPY docker/nginx.conf /etc/nginx/conf.d/
 
 # Copy static files
 COPY --chown=userapp:userapp . /usr/share/nginx/html/
 
-# Switch to non-privileged user
-USER userapp
-
 # Expose port
 EXPOSE 80
 
-# Start nginx
+# Start nginx (runs as root, serves files owned by userapp)
 CMD ["nginx", "-g", "daemon off;"]

docker/docker-compose.yml

@@ -17,7 +17,6 @@ services:
       timeout: 10s
       retries: 3
       start_period: 10s
-    user: "1000:1000"
 
   # Development service (live reload)
   dev:
@@ -29,7 +28,6 @@ services:
     volumes:
       - ../:/usr/share/nginx/html
     restart: unless-stopped
-    user: "1000:1000"
 
   # Production service with HTTPS support
   production:
@@ -43,4 +41,3 @@ services:
       - ./ssl:/etc/nginx/ssl:ro
       - ./nginx-ssl.conf:/etc/nginx/conf.d/default.conf:ro
     restart: unless-stopped
-    user: "1000:1000"