From 33e1129aebcec7ef2ed0ac05a92dfdfe1800108e Mon Sep 17 00:00:00 2001
From: RinCodeForge927 <dangnhatrin90@gmail.com>
Date: Sat, 10 Jan 2026 16:51:36 +0700
Subject: [PATCH] docker: run geth as non-root user

Establish a dedicated 'geth' user and group to run the process. This follows the principle of least privilege and improves container isolation by avoiding root execution within the final image.
---
 Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 9b70e9e8a0..437d2f593b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,8 +20,13 @@ RUN cd /go-ethereum && go run build/ci.go install -static ./cmd/geth
 FROM alpine:latest
 
 RUN apk add --no-cache ca-certificates
+RUN addgroup -g 1000 geth && \
+    adduser -u 1000 -G geth -s /bin/sh -D geth
+
 COPY --from=builder /go-ethereum/build/bin/geth /usr/local/bin/
 
+USER geth
+
 EXPOSE 8545 8546 30303 30303/udp
 ENTRYPOINT ["geth"]