From 56c661358cd949d5b7416f6fc884dac2905257db Mon Sep 17 00:00:00 2001
From: begininvoke <56797886+begininvoke@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:00:48 -0700
Subject: [PATCH] fix(security): By not specifying a USER, a program in the
 container may run as 'root'. This is a security hazard. If an

---
 agent-bot/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/agent-bot/Dockerfile b/agent-bot/Dockerfile
index 4cd1f20..33c551c 100644
--- a/agent-bot/Dockerfile
+++ b/agent-bot/Dockerfile
@@ -12,4 +12,5 @@ COPY agent-bot/src ./agent-bot/src
 
 ENV PORT=4200
 EXPOSE 4200
+USER bun
 CMD ["bun", "agent-bot/src/index.ts"]