Run the API container as a non-root user

[Copilot]

Codacy flagged the Linux container image because the final stage did not declare a runtime user, allowing the application to run as root. This change hardens the final image by explicitly switching execution to an unprivileged UID/GID.

• Runtime user hardening

  • adds an explicit USER 10001:10001 in the final image stage
  • ensures the application process does not start with root privileges by default

• File ownership alignment

  • updates the publish-stage copy to assign ownership during transfer into the final image
  • avoids permission mismatches when the app starts under the non-root user

• Result

  • the container retains the existing entrypoint and image flow
  • only the final runtime security posture changes

FROM base AS final
WORKDIR /app
COPY --from=publish --chown=10001:10001 /app/publish .
USER 10001:10001
ENTRYPOINT ["dotnet", "EstateReportingAPI.dll"]

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• f.feedz.io
  • Triggering command: /usr/bin/dotnet dotnet restore EstateReportingAPI.sln (dns block)
  • Triggering command: /usr/bin/dotnet dotnet restore EstateReportingAPI/EstateReportingAPI.csproj (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Security] By not specifying a USER, a program in the container may run as 'root'. This is a security hazard.</issue_title>
<issue_description>

Codacy ID: 43110db9c4d74c6bb872c415b7388f35

File: EstateReportingAPI/Dockerfile
Line: 24
Rule: Security (High)
Commit: 35ddf021c1ad4f674c3c48ee9c45313b93ba2553

Message: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard.

**Code Snippet:**
```csharp
ENTRYPOINT ["dotnet", "EstateReportingAPI.dll"] 
```

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Security] By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. #453

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.