harden: non-root docs container with tini and a healthcheck (#844)

* harden: non-root container with tini, healthcheck, and a robust entrypoint

entrypoint.sh: escape sed metacharacters (\, &, #) so any future DocSearch value substitutes literally instead of crashing the pass or corrupting the bundle; rewrite only files that still contain the placeholder, making restarts no-ops; on substitution failure, log a warning and start the server anyway rather than crash-looping under restart: unless-stopped.

Dockerfile: run as the built-in non-root node user (artifacts chowned so the runtime sed keeps write access); add tini as PID 1 so SIGTERM actually reaches node and docker stop takes ~1s instead of the 10s kill grace; add a HEALTHCHECK so a dead server shows as unhealthy instead of silently Up.

Container-tested: boots 202ms, all routes/assets/redirects OK, metacharacter-laden values injected literally, uid 1000, health reaches healthy, restart idempotent (no rewrites, value intact), docker stop 0s.

* harden: substitute DocSearch placeholders independently; strip CR/LF from values

Review findings: the three substitutions were &&-chained, so one failing value skipped the remaining valid ones; and a raw newline in a value breaks the single-line sed command. Run each substitution independently, accumulating failures into one warning, and strip CR/LF in escape() (no legitimate DocSearch token contains them).

Container-tested: newline-laden appId is sanitized and all three placeholders still apply with no warning; forced full failure logs all three sed errors plus one warning and the server still starts healthy.

---------

Co-authored-by: Brandon Hopkins <brandon@techhut.tv>

docker/Dockerfile

@@ -1,5 +1,12 @@
 FROM node:20-slim
 
+# tini runs as PID 1 and forwards signals to node (which doesn't install its
+# own SIGTERM handler, and as PID 1 would otherwise ignore it) — so
+# `docker stop` terminates in ~1s instead of waiting out the 10s kill grace.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends tini \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /usr/app
 
 ENV NODE_ENV=production
@@ -13,18 +20,31 @@ ENV PORT=3000
 # install here. The output is traced against the runner (Ubuntu/glibc), so this
 # runtime image must also be glibc (node:20-slim, NOT alpine/musl) or the traced
 # native binaries won't load.
-COPY .next/standalone ./
+#
+# Files are chowned to the non-root `node` user because entrypoint.sh rewrites
+# the DocSearch placeholders in .next with `sed -i` at runtime — that needs
+# write access under the runtime user.
+COPY --chown=node:node .next/standalone ./
 # standalone does not include static assets or the public dir — copy them in.
-COPY .next/static ./.next/static
-COPY public ./public
+COPY --chown=node:node .next/static ./.next/static
+COPY --chown=node:node public ./public
 
-COPY docker/entrypoint.sh ./entrypoint.sh
+COPY --chown=node:node docker/entrypoint.sh ./entrypoint.sh
 RUN chmod +x ./entrypoint.sh
 
+# Run as the base image's built-in non-root user (UID 1000). Port 3000 is
+# unprivileged, so no extra capability is needed.
+USER node
+
 EXPOSE 3000
 
+# Surfaces crash-loops and dead servers in `docker ps` / compose --wait /
+# Watchtower instead of them sitting silently "Up".
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:3000/').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+
 # entrypoint.sh substitutes the APP_NEXT_PUBLIC_DOCSEARCH_* placeholders baked
 # into .next with real values from the container env, then execs the CMD.
-ENTRYPOINT ["/usr/app/entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/app/entrypoint.sh"]
 
 CMD ["node", "server.js"]