mindroom 0.1.2__tar.gz → 0.1.3__tar.gz

{mindroom-0.1.2 → mindroom-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mindroom
-Version: 0.1.2
+Version: 0.1.3
 Summary: A universal interface for AI agents with persistent memory, where every conversation has a home
 Project-URL: documentation, https://github.com/mindroom-ai/mindroom
 Project-URL: homepage, https://github.com/mindroom-ai/mindroom

{mindroom-0.1.2 → mindroom-0.1.3}/local/instances/deploy/Dockerfile.backend

@@ -30,6 +30,10 @@ FROM public.ecr.aws/docker/library/python:3.12-slim AS final
 # Copy uv for runtime
 COPY --from=uv /uv /uvx /bin/
 
+# Set version for setuptools-scm at runtime (no .git in container)
+ARG VERSION=0.0.0
+ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION}
+
 WORKDIR /app
 
 # Install runtime dependencies (curl for health checks)
@@ -52,9 +56,15 @@ RUN chmod +x /app/run-backend.sh
 # Create necessary directories
 RUN mkdir -p /app/logs /app/mindroom_data
 
+# Create non-root user and set ownership
+RUN useradd -u 1000 -U -m mindroom && chown -R 1000:1000 /app
+
 # Set environment variable to indicate Docker mode
 ENV DOCKER_CONTAINER=1
 
+# Run as non-root user
+USER 1000:1000
+
 EXPOSE 8765
 # Run the app
 CMD ["/app/run-backend.sh"]

{mindroom-0.1.2 → mindroom-0.1.3}/local/instances/deploy/Dockerfile.frontend

@@ -22,17 +22,17 @@ ENV NODE_ENV=production
 # Build production bundle with optimizations
 RUN cd frontend && bun run build
 
-# Production stage - optimized for static serving
-FROM public.ecr.aws/nginx/nginx:alpine AS final
+# Production stage - unprivileged nginx (runs as UID 101 by default)
+FROM nginxinc/nginx-unprivileged:alpine AS final
 WORKDIR /usr/share/nginx/html
 
 # Only copy what's needed for production
 COPY --from=builder /app/frontend/dist ./
 
-# Create nginx config for SPA with proper routing
+# Create nginx config for SPA with proper routing (use port 8080, default for unprivileged)
 RUN cat > /etc/nginx/conf.d/default.conf << 'EOF'
 server {
-    listen 3003;
+    listen 8080;
     server_name _;
     root /usr/share/nginx/html;
 
@@ -47,10 +47,10 @@ server {
 }
 EOF
 
-# Expose port
-EXPOSE 3003
+# Expose port (8080 is default for nginx-unprivileged)
+EXPOSE 8080
 
 # No health check needed - K8s handles this via readiness/liveness probes
 
-# Start nginx server
+# Start nginx server (already runs as non-root UID 101)
 CMD ["nginx", "-g", "daemon off;"]